All Detections

Potential Rundll32 Execution With DLL Stored In ADS

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

Sigma