Suspicious Workstation Locking via Rundll32
This rule detects suspicious workstation locking activity initiated via rundll32.exe. Specifically, it looks for instances where rundll32.exe is the process image, its parent process is cmd.exe, and its command line contains both 'user32.dll,' and 'LockWorkStation'. This combination indicates an attempt to programmatically lock the workstation using a system binary proxy execution method, which can be abused by adversaries.
Sigma
