Rundll32 Execution With Uncommon DLL Extension
This rule detects the execution of rundll32.exe with a command line that does not specify a common DLL extension (.cpl, .dll, .inf). Adversaries often use rundll32.exe to execute malicious code, and by using uncommon or no extensions, they attempt to evade detection mechanisms that might look for standard rundll32.exe usage. The rule filters out known legitimate uses of rundll32.exe, such as those involving common extensions, local server invocations, MSIExec processes, and specific Microsoft EdgeUpdate processes.
Sigma
