Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
615 detections
Filters
Last updated
All Time
Detection languages
267
188
49
39
27
Contributors
133
104
101
80
38
Categories
492
293
67
43
33
Platforms
610
3
2
1
1
Products / Services
186
147
144
45
12
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
3
3
2
2
IDS Classtypes
1
IDS Protocols
1
Detects instances where rundll32.exe is executed by a process named 'eld0.exe' residing in user-writable or temporary directories (e.g., Users, ProgramData, Temp, AppData). This behavior is characteristic of execution flow hijacking or malicious payload loading from suspicious file paths.
Detects instances where rundll32.exe is executed by a process named 'eld0.exe' residing in user-writable or temporary directories (e.g., Users, ProgramData, Temp, AppData). This behavior is characteristic of execution flow hijacking or malicious payload loading from suspicious file paths.
Detects the execution of rundll32.exe with a command line pointing to a WebDAV share path (DavWWWRoot). This technique is commonly used to execute remote payloads by forcing the system to access a remote resource, often as part of a malicious DLL loading chain.
This rule detects unauthorized modification of the desktop wallpaper registry key to an empty string, typically used for desktop defacement or disruptive activity, followed by a system parameter refresh to apply the changes immediately. It monitors for the use of reg.exe to clear the wallpaper registry value and rundll32.exe to invoke the User32.dll UpdatePerUserSystemParameters function, which forces the Windows shell to refresh desktop settings.
This rule detects a specific and highly suspicious process lineage: pcalua.exe (Program Compatibility Assistant) spawning powershell.exe, which subsequently triggers WmiPrvSE.exe, followed by cmd.exe and finally rundll32.exe. This chain often indicates a sophisticated attempt to bypass security controls by nesting execution through legitimate Windows utilities.
Detects the use of rundll32.exe to invoke the MiniDump function from comsvcs.dll, which is a well-known technique to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to a file for credential harvesting.
Detects the execution of rundll32.exe with command-line arguments involving shell32.dll and SHCreateLocalShellFolderServer, which is associated with phishing lures. The rule correlates this execution with either a direct child relationship to web browsers (Chrome, Edge) or proximity in time to the execution of Microsoft Outlook, indicating potential spearphishing or web-based delivery of malicious payloads.
This query identifies creation/loading of SysExcSvc.dll and SysReadSvc.dll along with suspicious LSASS memory dumping, reverse SSH tunnel creation.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
Detects rundll32.exe executing a DLL that was written to a user-profile/AppData path within the preceding 15 minutes, consistent with CountLoader's taskType 3 command dispatch downloading and invoking an attacker-specified exported function.
Detects rundll32.exe executing a DLL located in a user-profile directory (Users, AppData, or Documents and Settings) shortly after that same DLL file was created or written, consistent with CountLoader's taskType 3 DLL delivery and execution behavior.
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Detects rundll32.exe execution loading a DLL from a remote WebDAV share over HTTPS, including pushd-mounted WebDAV shares and @SSL/DavWWWRoot UNC indicators. Observed as the initial execution stage of ACR Stealer's Campaign 1, where a ClickFix prompt launches cmd.exe which invokes rundll32.exe against a GUID-based WebDAV path to fetch and load a malicious DLL.
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects an interactive cmd.exe shell launched in quiet mode with redirected I/O by a regsvr32-loaded TAG-195 implant, matching shell_start C2 tasking.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Detects rundll32.exe loading davclnt.dll, which triggers the WebClient service to auto-start and perform a network callout to retrieve WebDAV-hosted content.
Detects execution of rundll32.exe where the command line contains a path structured as a GUID, initiated by commonly abused parents such as cmd.exe or explorer.exe. This pattern is often used by malicious payloads to execute code from temporary or obfuscated directories while masquerading as a legitimate Windows process.
Detects the execution of rundll32.exe from the AppData directory with a specific command-line argument 'jangadeiro'. This behavior is characteristic of the Lampion RAT, which uses rundll32.exe to proxy execution of its malicious DLL component stored within structured subdirectories in the user's AppData folder.
Page 6 of 30