Rundll32 Execution of DLL Masquerading as Non-Executable File Type
Detects rundll32.exe being invoked either: (a) against a file with a non-DLL/non-executable extension (e.g. .jpg, .png, .pdf, .txt, .ini, .html, .js) followed by an exported function call — a common evasion where a malicious DLL is renamed to a benign extension to bypass extension-based filtering, or (b) from a user-writable staging directory (Temp, AppData, ProgramData, Public, Downloads) — a broader signal since legitimate rundll32 targets are almost always shipped under Program Files/System32, not dropped into user-writable paths at runtime. Excludes cases where the parent process is msiexec.exe, since MSI custom actions legitimately spawn rundll32 against .tmp/.dat staging files during installation.
Sigma
