Rhadamanthys Stealer Module Launch Via Rundll32.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•40

Detects the use of rundll32.exe to launch an NSIS (Nullsoft Scriptable Install System) module, specifically looking for 'nsis_uns' and 'PrintUIEntry' in the command line. This behavior has been observed in the Rhadamanthys infostealer, where rundll32.exe is used to execute its main stealer capability.