RunDLL32 Spawning Explorer.exe
This rule detects an unusual process creation event where 'rundll32.exe' spawns 'explorer.exe' as a child process. This behavior is uncommon and has been observed in malware such as Gamarue, which uses this method to launch 'explorer.exe' in an atypical manner. The rule specifically filters out legitimate instances where 'rundll32.exe' might launch 'explorer.exe' via 'shell32.dll,Control_RunDLL', aiming to reduce false positives.
Sigma
