Kimsuky NUKESPED rundll32 Proxy Execution via Script Interpreter Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects instances where rundll32.exe is spawned from scripting engines (wscript.exe, cscript.exe, powershell.exe, pwsh.exe) or executes from non-standard directories like AppData\Local\Temp or ProgramData. This behavior is commonly indicative of malicious proxy execution to bypass security controls.