Suspicious Rundll32 Crypto DLL Load
Detects the execution of rundll32.exe attempting to load incorrectly spelled crypto DLLs from the AppData or Temp directories, specifically looking for "mcrypto.chiper" or "rypto.dll" in the command line, along with the export function "mcrypto_clean". This activity is associated with hands-on keyboard activity in the DAEMON Tools supply chain attack.
Microsoft Sentinel (KQL)
