Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
615 detections
Filters
Last updated
All Time
Detection languages
267
188
49
39
27
Contributors
133
104
101
80
38
Categories
492
293
67
43
33
Platforms
610
3
2
1
1
Products / Services
186
147
144
45
12
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
3
3
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation of potentially suspicious child processes by WinRAR.exe. Adversaries may exploit vulnerabilities in WinRAR, such as CVE-2023-38831, to achieve arbitrary code execution. This rule specifically looks for WinRAR.exe spawning common scripting or execution binaries like cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Such activity is highly indicative of an adversary attempting to execute further commands or payloads after exploiting WinRAR.
Detects the execution of rundll32.exe with a command line that specifically loads a DLL named "1.dll" and calls the "DllRegisterServer" export function. This pattern has been observed in malware campaigns, particularly those involving IcedID.
Detects the execution of 'rundll32.exe' where the loaded DLL does not have a '.dll' extension, often observed in Qakbot activity. The rule specifically looks for 'rundll32.exe' being spawned by common scripting or command-line interpreters and for the command line to contain paths frequently used by Qakbot for its payloads.
Detects suspicious execution of rundll32.exe with specific DLLs and functions that are known to be abused for defense evasion and arbitrary code execution, often referred to as Living Off The Land Binaries (LOLBINs). The rule identifies various combinations of DLLs (e.g., url.dll, zipfldr.dll, shell32.dll, mshtml.dll, advpack.dll, ieadvpack.dll, ieframe.dll, shdocvw.dll, syssetup.dll, setupapi.dll, pcwutl.dll, dfshim.dll, scrobj.dll, shimgvw.dll, comsvcs.dll) and their associated functions that can be used to execute scripts, open URLs, or perform other actions in an unexpected manner via rundll32.exe. It includes filters to reduce false positives from legitimate system activities like screensaver or control panel operations.
Detects a specific process tree pattern associated with Trickbot malware, where 'rundll32.exe' acts as the parent process for 'wermgr.exe', and the parent command line contains 'DllRegisterServer'. This pattern indicates the execution of a DLL via rundll32.exe, which then launches wermgr.exe, a known behavior of Trickbot.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments like 'C:\windows\system32\davclnt.dll,DavSetCookie'. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
Detects potential PowerShell execution from a DLL instead of the usual PowerShell process, as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.
This rule detects potential Emotet malware activity by monitoring the creation of `rundll32.exe` processes. Specifically, it looks for `rundll32.exe` command lines that end with `,RunDLL` or `,Control_RunDLL`, which are common patterns used by Emotet for DLL loading. The rule includes filters to reduce false positives from legitimate DLL executions and specific development environment scenarios.
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
This rule detects an unusual process creation event where 'rundll32.exe' spawns 'explorer.exe' as a child process. This behavior is uncommon and has been observed in malware such as Gamarue, which uses this method to launch 'explorer.exe' in an atypical manner. The rule specifically filters out legitimate instances where 'rundll32.exe' might launch 'explorer.exe' via 'shell32.dll,Control_RunDLL', aiming to reduce false positives.
This rule detects the execution of ZxShell malware by monitoring process creation events. Specifically, it looks for 'rundll32.exe' being executed with command-line arguments containing either 'zxFunction' or 'RemoteDiskXXXXX'. These strings are known indicators of ZxShell's operational behavior when launched via rundll32.
Detects the execution of a process with command-line arguments containing '-export dll_u' or ending with ',dll_u' or ' dll_u'. This specific export function name 'dll_u' is known to be used by tools associated with the Equation Group, indicating potential malicious activity related to their implants or frameworks.
This rule detects potential remote thread injection activities associated with the Bumblebee malware. Specifically, it looks for instances where 'wabmig.exe', 'wab.exe', or 'ImagingDevices.exe' create a remote thread in 'rundll32.exe'. This behavior is indicative of how Bumblebee operates to execute its malicious payload.
Detects the execution of 'rundll32.exe' by a 'svchost.exe' process, specifically when the 'svchost.exe' is running with command-line arguments associated with the ColdSteel RAT persistence mechanism (e.g., '-k msupdate', '-k msupdate2', '-k alg'). The 'rundll32.exe' process further executes specific functions ('UpdateDriverForPlugAndPlayDevicesW', 'ServiceMain', 'DiUninstallDevice') which are indicative of the ColdSteel RAT's cleanup or operational commands. This behavior is noted to be specific to certain ColdSteel RAT samples and not present in older versions.
This rule detects the creation of screensaver files (.scr) in locations outside of standard Windows system directories. Attackers often leverage .scr files, which are essentially executable files, to deliver and execute malicious payloads. By filtering out common legitimate system paths, the rule aims to identify suspicious instances where an .scr file might be dropped or created by an adversary, potentially as part of a defense evasion or execution technique. The rule's description specifically mentions the use of "rundll32.exe desk.cpl,InstallScreenSaver" as an example of how an attacker might execute such a file.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
This rule detects suspicious process creation activity involving 'rundll32.exe' executing a DLL from a user's local application data directory, specifically looking for command-line patterns that include '.dat"' or '.dll #1'. This behavior is characteristic of the Sofacy (APT28) Trojan loader. The rule filters out executions from the temporary directory to reduce false positives.
Detects file indicators associated with a 2018 phishing campaign attributed to APT29 (Cozy Bear), as reported by Mandiant. The rule specifically looks for the creation or modification of files named 'ds7002.lnk', 'ds7002.pdf', or 'ds7002.zip'.
This rule detects the execution of 'rundll32.exe' when it is spawned by specific parent processes (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and the command line contains paths commonly used by Qakbot for persistence or execution (e.g., ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming) along with a '.dll' extension. This combination of indicators is often associated with Qakbot malware activity.
Page 27 of 30