LOLBin Proxy Execution via rundll32/regsvr32/mshta/msiexec

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects the execution of known Windows system binaries (rundll32, regsvr32, mshta, msiexec) with command-line arguments indicative of proxy execution or script-based attacks. The rule identifies patterns commonly associated with downloading or executing remote payloads, including the use of URLs, JavaScript, VBScript, or specific DLL exports designed to execute code indirectly or from a remote source.