Potentially Suspicious Rundll32 Activity — Detection Rule
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities