Windows Rundll32 Apply User Settings Changes — Detection Rule
The following analytic detects the execution of rundll32 with a call to the user32 DLL, specifically the UpdatePerUserSystemParameters function. This function is responsible for updating system parameters, such as desktop backgrounds, display settings, and visual themes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions. This activity can be significant as it is an uncommon way to apply settings. It was also observed as part of Rhysida Ransomware activity. If confirmed malicious, this could allow an attacker to disguise activities or make unauthorized system changes, potentially leading to persistent unauthorized access.