DLL Call by Ordinal Via Rundll32.EXE
This rule detects the execution of rundll32.exe when it attempts to call a DLL export by its ordinal number. This technique is often used by malware for defense evasion, as it can bypass security tools that might not monitor rundll32.exe or its specific command-line arguments. The rule specifically looks for command-line patterns like ',#' or '.dll #' which indicate an ordinal call. It includes filters to reduce false positives from legitimate Windows components like EDGEHTML.dll or Visual Studio build processes.
Sigma
