Potential Renamed Rundll32 Execution
Detects when 'DllRegisterServer' is called in the command line of a process that is not 'rundll32.exe'. This behavior is indicative of an adversary renaming the 'rundll32' utility to evade detection, while still leveraging its functionality to execute DLLs.
Sigma
