Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
25
9
5
1
1
Contributors
16
8
4
4
4
Categories
39
14
11
6
6
Platforms
41
6
1
1
Products / Services
17
16
8
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
IDS Classtypes
1
IDS Protocols
1
This rule detects suspicious execution of rundll32.exe when its parent process is control.exe, specifically excluding cases where 'Shell32.dll' is present in the command line. This behavior has been observed in attacks by the Equation Group and exploit kits to load malicious DLLs via the Control Panel process, often as a defense evasion technique.
Page 3 of 3