Shell32 DLL Execution in Suspicious Directory (32b96012-7892-429e-b26c-ac2bf46066ff)

Detects shell32.dll executing a DLL in a suspicious directory

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	Shell32 DLL Execution in Suspicious Directory (32b96012-7892-429e-b26c-ac2bf46066ff)	Sigma-Rules	1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	2