Potential ShellDispatch.DLL Functionality Abuse via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects potential abuse of "ShellDispatch.dll" functionality to execute arbitrary binaries via "ShellExecute" using rundll32.exe. This technique involves rundll32.exe being executed with a command line containing 'RunDll_ShellExecuteW'.