Remote SMB Share Mount Followed by Rundll32 Execution

F S@Fsdr

•updated Jun 26, 2026•1•0•6

This rule detects the use of the 'pushd' command in the Windows Command Shell (cmd.exe) to mount a remote network share, immediately followed by the execution of a file on that remote share using 'rundll32.exe'. This pattern is a common technique used by attackers to execute malicious code (DLLs) stored on remote servers or network shares.