Suspicious Rundll32 Activity Invoking Sys File

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects suspicious activity where 'rundll32.exe' is used in the command line to invoke a '.sys' file. This behavior has been observed in attacks attributed to UNC2452 (NOBELIUM).