Rundll32 Execution of Downloaded DLL with 'Begin' Export
This rule detects the execution of rundll32.exe where it attempts to load a DLL from common user-writable directories (Temp, AppData, Downloads, Users\Public) and specifically calls the 'Begin' export function. This behavior is often associated with malware attempting to execute malicious code via a legitimate Windows binary.
Cortex XDR
