Detects rundll32 execution where the DLL is located on a remote location (share)
Read the full analysis on IntelFusions