Rundll32 Execution without Command Line Arguments

Ethan Andrews@eandrews

•updated Feb 23, 2026•3•0•66

Detects the execution of rundll32.exe without any command-line arguments. This is a high-confidence indicator of process hollowing or reflective injection, as observed in campaigns distributing the Winos4.0 framework and ValleyRAT.