Rundll32 Launched via start /min from AppData Script Loading Non-Standard DLL
Detects rundll32.exe being launched via a start /min command from a script located in the AppData directory, which then loads a non-standard DLL. This behavior is often associated with malware that uses rundll32 to execute malicious code while attempting to minimize visibility by running the process in a minimized window.
Sigma
