Potential Renamed Rundll32 Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection