Potential Obfuscated Ordinal Call Via Rundll32
This rule detects the execution of 'rundll32.exe' with command-line arguments that suggest an obfuscated ordinal call. Ordinal calls are a way to execute functions within a DLL by their numerical index rather than their name. Adversaries may obfuscate these ordinal numbers by adding leading zeros or using large numbers that wrap around due to 16-bit integer limitations, making the command line harder to analyze and potentially bypassing signature-based detections.
Sigma
