Rundll32 Spawned Via Explorer.EXE
Detects the execution of 'rundll32.exe' when its parent process is 'explorer.exe'. This behavior has been observed in variants of the Raspberry Robin malware, as initially reported by Red Canary. The rule includes filters to reduce false positives from legitimate Windows operations, such as volume control.
Sigma
