TAIDOOR RAT DLL Load via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

Detects the execution pattern associated with the TAIDOOR RAT malware loading its DLL component. Specifically, it looks for command-line arguments containing 'dll,MyStart' or 'dll MyStart' in conjunction with 'rundll32.exe', which is a known method for TAIDOOR to load its malicious DLL.