Suspicious Renamed Comsvcs DLL Loaded By Rundll32 — Detection Rule

Detects rundll32 loading a renamed comsvcs.dll to dump process memory

Read the full analysis on IntelFusions