Turla Kazuar DLL Loaded via rundll32 Following Gamaredon PowerShell Downloader

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•6

Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.