Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
This rule detects the invocation of the 'Archer' malware using 'rundll32.exe'. Specifically, it looks for command-line arguments containing both 'rundll32.exe' and 'InstallArcherSvc'. This pattern indicates an attempt to execute a malicious DLL function named 'InstallArcherSvc' via the legitimate Windows utility 'rundll32.exe', which is a common technique for defense evasion and execution.
