LegionLoader dllhost.exe Signed Binary Proxy Execution of .cpl Applet
Detects the execution of Control Panel applets (.cpl) via unconventional proxy binaries like dllhost.exe or rundll32.exe. This pattern is commonly observed in malware attempting to execute malicious DLLs by leveraging Windows system binaries to bypass security controls and application whitelisting.
Splunk (SPL)
