Potentially Suspicious Rundll32 Activity
Detects suspicious execution of rundll32.exe with specific DLLs and functions that are known to be abused for defense evasion and arbitrary code execution, often referred to as Living Off The Land Binaries (LOLBINs). The rule identifies various combinations of DLLs (e.g., url.dll, zipfldr.dll, shell32.dll, mshtml.dll, advpack.dll, ieadvpack.dll, ieframe.dll, shdocvw.dll, syssetup.dll, setupapi.dll, pcwutl.dll, dfshim.dll, scrobj.dll, shimgvw.dll, comsvcs.dll) and their associated functions that can be used to execute scripts, open URLs, or perform other actions in an unexpected manner via rundll32.exe. It includes filters to reduce false positives from legitimate system activities like screensaver or control panel operations.
Sigma
