TELEPUZ DLL loaded via rundll32.exe with Control_RunDLL or ServiceRoutine
Detects the execution of rundll32.exe with specific suspicious DLLs (drx_curator.dll, etwhost.dll) and specific function names or paths. This pattern is indicative of potential malicious activity where legitimate binaries are leveraged to execute code, often associated with modular loaders or malicious payloads.
Microsoft Sentinel (KQL)
