Shell32 DLL Execution in Suspicious Directory — Detection Rule

Detects shell32.dll executing a DLL in a suspicious directory

Read the full analysis on IntelFusions