LegionLoader CPL Proxy Execution via dllhost.exe or rundll32.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects malicious Control Panel (.cpl) file execution via legitimate Windows binaries like dllhost.exe or rundll32.exe. Attackers often abuse these binaries to bypass security controls. The rule specifically alerts on instances where these processes are launched from non-standard parent processes or from high-risk directories such as AppData or Temp.