Rundll32 /sta CLSID invocation hiding loader DLL path
Detects the execution of rundll32.exe with the '/sta' command line argument followed by a CLSID. This behavior leverages the IShellRunDll COM interface to execute registered objects, bypassing the standard requirement of providing a DLL path and exported function name. This method is often used by adversaries to execute malicious code while blending in with legitimate system processes.
Microsoft Sentinel (KQL)
