Cobalt Strike spawn-to: rundll32.exe launched with no arguments

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•1

Detects instances where rundll32.exe is executed with no arguments or minimal arguments, matching the typical Cobalt Strike spawn-to sacrificial process behavior. Aggregated per device, account, and parent process.