Rundll32 UNC Path Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•18

Detects rundll32 execution where the DLL is located on a remote network share (UNC path). This technique is often used by adversaries for defense evasion, execution, and lateral movement by leveraging a legitimate Windows utility to load and execute malicious code from a remote location.