Remote DLL Load Via Rundll32.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects when 'rundll32.exe' attempts to load a DLL from a remote network path (e.g., a UNC path starting with '\\'). This behavior is often indicative of malicious activity, as legitimate rundll32.exe usage typically involves loading local DLLs.