Suspicious Call by Ordinal (e79a9e79-eb72-4e78-a628-0e7e8f59e89c)

Detects suspicious calls of DLLs in rundll32.dll exports by ordinal

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	Suspicious Call by Ordinal (e79a9e79-eb72-4e78-a628-0e7e8f59e89c)	Sigma-Rules	1
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2