Rundll32 UNC Path Execution

SigmaHQ Detections@sigmaHQ

•updated Jul 27, 2026•1•0•2

Detects rundll32 execution where the DLL is located on a remote location (share)