YARA · SecuInfra Falcon Team

SECUINFRA_SUSP_Powershell_Download_Temp_Rundll

Detect a Download to %temp% and execution with rundll32.exe

What this rule detects

Detect a Download to %temp% and execution with rundll32.exe

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Author: SECUINFRA Falcon Team

Source repository: SecuInfra Falcon Team @ 2d7c66d7d1

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 6b09a6f0-29c6-5baf-ae64-7aa49a37a9d3

SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_OBFUS_Powershell_ExecutionMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27