Qakbot Rundll32 Fake DLL Extension Execution
Detects the execution of 'rundll32.exe' where the loaded DLL does not have a '.dll' extension, often observed in Qakbot activity. The rule specifically looks for 'rundll32.exe' being spawned by common scripting or command-line interpreters and for the command line to contain paths frequently used by Qakbot for its payloads.
Sigma
