Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
615 detections
Filters
Last updated
All Time
Detection languages
267
188
49
39
27
Contributors
133
104
101
80
38
Categories
492
293
67
43
33
Platforms
610
3
2
1
1
Products / Services
186
147
144
45
12
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
3
3
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects the execution of `rundll32.exe` attempting to load `shell32.dll` with the `Control_RunDLL` function, specifically when the DLL is located in suspicious user-writable directories such as `AppData`, `LocalAppData`, `Temp`, or `Users\Public`. This behavior is often indicative of defense evasion techniques used by malware to execute malicious code from non-standard locations.
Detects suspicious activity where 'rundll32.exe' is used in the command line to invoke a '.sys' file. This behavior has been observed in attacks attributed to UNC2452 (NOBELIUM).
This rule detects the creation of unusual child processes originating from 'SndVol.exe', which is the legitimate Windows volume mixer. The rule specifically filters out 'rundll32.exe' when it's used with 'shell32.dll,Control_RunDLL', as this is a common and legitimate behavior. Any other child processes spawned by 'SndVol.exe' are considered suspicious and could indicate an attempt to hide malicious activity behind a legitimate process.
Detects the execution of rundll32 where the DLL being called is stored within an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious code.
Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...). This technique can be used for defense evasion and execution of malicious code.
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Page 30 of 30