Potential Rundll32 Execution With DLL Stored In ADS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects the execution of rundll32 where the DLL being called is stored within an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious code.