F-Secure C3 NodeRelay DLL Loading via Rundll32
This rule detects the execution of `rundll32.exe` with a DLL containing the exported function `StartNodeRelay`. This specific function is associated with F-Secure C3, a command and control framework. Detection indicates potential use of this tool for malicious purposes, likely for defense evasion and establishing C2 communications.
Sigma
