SloppyRAT Malformed rundll32 Run Key Persistence

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•6

This rule detects the creation or modification of Windows Registry Run keys that execute rundll32.exe. This is a common persistence technique where attackers configure malicious DLLs or scripts to run automatically upon user logon or system boot by leveraging the Rundll32 utility.