All Detections

Rundll32 (LOLBins and LOLScripts, Normalized Process Events)

Azure Sentinel@AzureSentinel
updated Jun 17, 20252022

'This detection uses Normalized Process Events to hunt Signed Binary Proxy Execution: Rundll32 activities'

Microsoft Sentinel (KQL)