Suspicious Control Panel DLL Load via Rundll32
This rule detects suspicious execution of rundll32.exe when its parent process is control.exe, specifically excluding cases where 'Shell32.dll' is present in the command line. This behavior has been observed in attacks by the Equation Group and exploit kits to load malicious DLLs via the Control Panel process, often as a defense evasion technique.
Sigma
