Rundll32 Execution Without Arguments Followed by Network Connection

This analytic detects the execution of rundll32.exe without any command-line arguments, immediately followed by a network connection. This behavior is suspicious because rundll32.exe typically requires arguments to perform legitimate functions. Its use without arguments, especially when combined with network activity, is often indicative of malicious activity, such as the execution of Cobalt Strike beacons or other malware attempting to establish unauthorized network communications for data exfiltration or further system compromise. The detection relies on correlating endpoint process telemetry with network traffic data.