Skip to content

Hide Navigation Hide TOC

Suspicious Rundll32 Activity Invoking Sys File (731231b9-0b5d-4219-94dd-abb6959aa7ea)

Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious Rundll32 Activity Invoking Sys File (731231b9-0b5d-4219-94dd-abb6959aa7ea) Sigma-Rules Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 2