Suspicious Rundll32 Invoking Inline VBScript

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•18

Detects suspicious execution of rundll32.exe with command-line arguments that indicate the invocation of inline VBScript. This behavior has been observed in attacks attributed to UNC2452 (APT29/NOBELIUM), specifically using patterns like 'Execute', 'RegRead', and 'window.close' within the command line to execute malicious VBScript.