Rundll32 Execution Without Parameters

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•0

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module