Rundll32/Dllhost Browser Process Injection
Detects rundll32.exe or dllhost.exe performing remote thread injection into web browser processes (chrome.exe, msedge.exe, firefox.exe). This activity is often associated with defense evasion and credential theft staging, as observed in campaigns like ClearFake/ClickFix, before a full Remote Access Trojan (RAT) is established.
Microsoft Sentinel (KQL)
