Potential Emotet Rundll32 Execution
This rule detects potential Emotet malware activity by monitoring the creation of `rundll32.exe` processes. Specifically, it looks for `rundll32.exe` command lines that end with `,RunDLL` or `,Control_RunDLL`, which are common patterns used by Emotet for DLL loading. The rule includes filters to reduce false positives from legitimate DLL executions and specific development environment scenarios.
Sigma
