Rundll32 LockWorkStation Execution

This analytic detects the execution of the rundll32.exe command with the user32.dll,LockWorkStation parameter. This specific command is used to lock the workstation via the command line, which is an uncommon method. This activity has been observed in CONTI ransomware tooling for defense evasion purposes. If confirmed malicious, this technique could indicate an attempt to evade detection and hinder incident response efforts.