Rundll32 Execution with Registered COM Object Loading
This rule detects the execution of rundll32.exe with command-line arguments indicative of loading registered COM objects. Specifically, it looks for `rundll32.exe` processes where the command line contains both `{-sta` or `-localserver` and curly braces (`{`, `}`). This pattern is often used by adversaries to achieve persistence or privilege escalation by hijacking COM objects and executing malicious code through them.
Sigma
