Rundll32 Execution with Network Connection from Explorer

Ankit Mehta@Secvyn

•updated Mar 31, 2026•11•0•113

Detects suspicious execution of rundll32.exe initiated by explorer.exe that includes network-related command-line arguments (http, https, .dll, entrypoint). This pattern can indicate malicious DLL loading or execution attempting to establish network communication, potentially for command and control or data exfiltration. The rule filters out common system accounts and focuses on infrequent occurrences.