Injected Browser Process Spawning Rundll32 - GuLoader Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•36

Detects the execution of GuLoader malware where a rundll32.exe process is spawned by an injected browser process (chrome.exe, firefox.exe, or msedge.exe). This behavior indicates potential malware activity, specifically GuLoader initiating network connections.