Rundll32 Execution Without CommandLine Parameters

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects suspicious execution of rundll32.exe without any command-line parameters, which is a known technique used by Cobalt Strike beacons for defense evasion. The rule specifically filters out common legitimate parent processes to reduce false positives.