Rundll32 Execution with Suspicious DLL Names or Hashes (ColdRiver Activity)
This rule detects the execution of 'rundll32.exe' with suspicious DLL names in the command line, specifically 'machinerie.dll', 'checkme.dll', or 'iamnotarobot.dll'. Additionally, it identifies the loading of specific malicious DLLs by their SHA256 hashes, which have been associated with ColdRiver (Star Blizzard) activity. This behavior is indicative of potential malware execution or persistence mechanisms.
Cortex XDR
