ZxShell Malware Execution via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects the execution of ZxShell malware by monitoring process creation events. Specifically, it looks for 'rundll32.exe' being executed with command-line arguments containing either 'zxFunction' or 'RemoteDiskXXXXX'. These strings are known indicators of ZxShell's operational behavior when launched via rundll32.