Potential Qakbot Rundll32 Execution
This rule detects the execution of 'rundll32.exe' when it is spawned by specific parent processes (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and the command line contains paths commonly used by Qakbot for persistence or execution (e.g., ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming) along with a '.dll' extension. This combination of indicators is often associated with Qakbot malware activity.
Sigma
