Rundll32 Execution with Suspicious DLLs

Ankit Mehta@Secvyn

•updated Jun 5, 2026•1•0•6

Detects the execution of rundll32.exe with command-line arguments containing 'samcli.dll' or 'vaultcli.dll'. This pattern can indicate an attempt to execute malicious code or bypass security controls using a legitimate Windows utility.