Rundll32.EXE Calling DllRegisterServer Export Function from Non-Standard Path

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•19

Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path. This behavior is often abused by adversaries to execute malicious DLLs for defense evasion.