Tomb Crypter Suspicious Rundll32 Execution (Interlock/Rhysida)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•9

This rule detects suspicious execution of rundll32.exe by the Tomb crypter, which is known to unpack and execute malicious DLLs. The detection logic specifically looks for rundll32.exe processes where the command line ends with ",rundll" and the executable is located in common temporary or public user directories such as AppData\Local\Temp, ProgramData, or Users\Public. This pattern is indicative of the Interlock/Rhysida ransomware ecosystem.