Fake Lock Screen Credential Harvesting via Rundll32
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Microsoft Sentinel (KQL)
