Rundll32 shell32.dll SHCreateLocal execution correlated with browser/mail-client parent chain
Detects the execution of rundll32.exe with command-line arguments involving shell32.dll and SHCreateLocalShellFolderServer, which is associated with phishing lures. The rule correlates this execution with either a direct child relationship to web browsers (Chrome, Edge) or proximity in time to the execution of Microsoft Outlook, indicating potential spearphishing or web-based delivery of malicious payloads.
Microsoft Sentinel (KQL)
