Rundll32 Outbound Internet Connection
This rule detects instances where 'rundll32.exe' initiates an outbound network connection to a public IP address. It filters out connections to common local, private, and Microsoft-owned IP ranges, as well as specific legitimate command lines and Azure internal hostnames, to reduce false positives. The rule aims to identify suspicious network activity originating from rundll32.exe, which is often abused by malware for defense evasion and execution.
Sigma
