Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1218.011

Rundll32

Stealth 90 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
sigma Rundll32 Execution With Uncommon DLL Extension test 2026-10-13
splunk RunDLL Loading DLL By Ordinal production 2026-10-09
elastic Script Execution via Microsoft HTML Application production 2026-10-09
elastic Suspicious Microsoft HTML Application Child Process production 2026-10-09
elastic Suspicious SolarWinds Web Help Desk Java Module Load or Child Process production 2026-10-09
elastic Potential FileFix Command via Windows Explorer Address Bar production 2026-10-05
elastic Potential ClickFix Command via Windows Run Dialog production 2026-10-05
splunk Suspicious Rundll32 StartW production 2026-10-02
splunk Windows Application Whitelisting Bypass Attempt via Rundll32 production 2026-10-02
splunk Rundll32 Control RunDLL Hunt production 2026-10-02
elastic Execution via OpenClaw Agent production 2026-09-25
splunk Windows LOLBAS Executed As Renamed File deprecated 2026-09-23
splunk Windows LOLBAS Executed Outside Expected Path production 2026-09-22
elastic Potential Command and Control via Internet Explorer production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic Execution of Persistent Suspicious Program production 2026-09-18
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Windows Server Update Service Spawning Suspicious Processes production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Suspicious Execution from VS Code Extension production 2026-09-18
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
elastic Execution from Unusual Directory - Command Line production 2026-09-18
elastic Execution via GitHub Actions Runner production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Command Shell Activity Started via RunDLL32 production 2026-09-18
elastic Unusual Network Connection via RunDLL32 production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Unusual Child Processes of RunDLL32 production 2026-09-18
elastic Suspicious .NET Code Compilation production 2026-09-18
elastic Potential Credential Access via Renamed COM+ Services DLL production 2026-09-18
elastic Potential Local NTLM Relay via HTTP production 2026-09-18
elastic Rare Connection to WebDAV Target production 2026-09-18
elastic Potential Credential Access via Windows Utilities production 2026-09-18
elastic Suspicious Shell Execution via Velociraptor production 2026-09-18
elastic Potential Protocol Tunneling via Yuze production 2026-09-18
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
sigma Rundll32 UNC Path Execution test 2026-07-20
splunk Rundll32 with no Command Line Arguments with Network production 2026-05-13
splunk Rundll32 Control RunDLL World Writable Directory production 2026-05-13
splunk Rundll32 LockWorkStation production 2026-05-13
splunk Rundll32 Process Creating Exe Dll Files production 2026-05-13
splunk Suspicious IcedID Rundll32 Cmdline production 2026-05-13
splunk Suspicious Rundll32 dllregisterserver production 2026-05-13
splunk Suspicious Rundll32 no Command Line Arguments production 2026-05-13
splunk Suspicious Rundll32 PluginInit production 2026-05-13
splunk Windows Rundll32 Apply User Settings Changes production 2026-05-13
splunk Windows Rundll32 Load DLL in Temp Dir production 2026-05-13
splunk Windows Rundll32 with Non-Standard File Extension production 2026-05-13
splunk Rundll32 DNSQuery production 2026-05-13
sigma Unsigned DLL Loaded by Windows Utility test 2025-10-07
sigma Suspicious ShellExec_RunDLL Call Via Ordinal test 2024-12-01
sigma Potentially Suspicious Rundll32.EXE Execution of UDL File test 2024-08-16
sigma Bad Opsec Defaults Sacrificial Processes With Improper Arguments test 2024-08-15
sigma DLL Call by Ordinal Via Rundll32.EXE stable 2024-07-16
sigma Kapeka Backdoor Execution Via RunDLL32.EXE test 2024-07-03
sigma Kapeka Backdoor Loaded Via Rundll32.EXE test 2024-07-03
sigma Rundll32 Internet Connection test 2024-03-13
sigma Outbound Network Connection To Public IP Via Winlogon test 2024-03-12
sigma Potential PowerShell Execution Via DLL test 2024-03-07
sigma Potential Raspberry Robin CPL Execution Activity test 2024-03-07
sigma Remote Thread Creation Via PowerShell In Uncommon Target test 2023-11-10
sigma IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 test 2023-08-31
sigma SCR File Write Event test 2023-08-23
sigma ScreenSaver Registry Key Set test 2023-08-17
sigma Sofacy Trojan Loader Activity test 2023-05-31
sigma Potentially Suspicious Rundll32 Activity test 2023-05-17
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma Suspicious Rundll32 Execution With Image Extension test 2023-03-13
sigma Equation Group DLL_U Export Function Load stable 2023-03-09
sigma EvilNum APT Golden Chickens Deployment Via OCX Files test 2023-03-09
sigma APT29 2018 Phishing Campaign CommandLine Indicators stable 2023-03-08
sigma HackTool - F-Secure C3 Load by Rundll32 test 2023-03-05
sigma HackTool - RedMimicry Winnti Playbook Execution test 2023-03-01
sigma Potential Emotet Rundll32 Execution test 2023-02-21
sigma APT29 2018 Phishing Campaign File Indicators stable 2023-02-20
sigma Shell32 DLL Execution in Suspicious Directory test 2023-02-09
sigma Code Execution via Pcwutl.dll test 2023-02-09
sigma Rundll32 InstallScreenSaver Execution test 2023-02-09
sigma Suspicious Control Panel DLL Load test 2023-02-09
sigma Rhadamanthys Stealer Module Launch Via Rundll32.EXE test 2023-02-05
sigma NotPetya Ransomware Activity test 2022-12-15
sigma Suspicious Rundll32 Activity Invoking Sys File test 2022-10-09
sigma Potential Bumblebee Remote Thread Creation test 2022-09-27
sigma CobaltStrike Load by Rundll32 test 2022-09-16
sigma RunDLL32 Spawning Explorer test 2022-05-25
sigma Process Access via TrolleyExpress Exclusion test 2022-05-13
sigma ZxShell Malware test 2021-11-27
sigma Suspicious Rundll32 Setupapi.dll Activity test 2021-11-27
sigma Fireball Archer Install test 2021-11-27