Rundll32 Proxy Execution Payload Delivered

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the delivery of a payload that attempts to use rundll32.exe for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing both "rundll32.exe" and ".dll," (case-insensitive) in the file data, indicating a potential malicious DLL being delivered for execution via rundll32.