Rundll32 InstallScreenSaver Execution for Defense Evasion
This rule detects the execution of `rundll32.exe` with the `InstallScreenSaver` command-line argument. This technique can be abused by attackers to execute arbitrary applications as a screensaver file (.scr) for defense evasion, as `rundll32.exe` is a legitimate Windows utility. The rule specifically looks for `rundll32.exe` (or its original filename) and the `InstallScreenSaver` string in the command line.
Sigma
