udm rundll32 begin udm context

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•4•0•7

Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.