TA4922 HR Lure Archive Launches DLL Loader
This rule detects the execution of Windows system utilities (rundll32.exe, regsvr32.exe, msiexec.exe) with command-line arguments that suggest the loading of DLLs, CPLs, or MSIs, often associated with HR-themed lures (e.g., payroll, tax, resume) and originating from the Downloads folder. This behavior is indicative of a DLL loader being launched, potentially from a malicious archive.
Microsoft Sentinel (KQL)
