Rundll32 Begin Export Staging Path
Detects rundll32.exe loading a DLL from a user-writable staging directory and invoking its Begin export, a loader pattern used in the Ghost CMS/ClickFix campaign. Since legitimate software rarely loads DLLs from these locations via a Begin export, this is a high-fidelity indicator of malicious proxy execution (MITRE T1218.011).
YARA
