Shell32 DLL Execution in Suspicious Directory

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the execution of `rundll32.exe` attempting to load `shell32.dll` with the `Control_RunDLL` function, specifically when the DLL is located in suspicious user-writable directories such as `AppData`, `LocalAppData`, `Temp`, or `Users\Public`. This behavior is often indicative of defense evasion techniques used by malware to execute malicious code from non-standard locations.