Suspicious Rundll32 Execution with Image Extension

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the execution of Rundll32.exe where the command line contains file extensions commonly associated with image files. This behavior is suspicious as Rundll32.exe is typically used to execute DLL functions, and its use with image file extensions can indicate an attempt to masquerade malicious DLLs or scripts as benign image files to evade detection.