System Binary Proxy Execution via Rundll32
Detects the execution of rundll32.exe process with suspicious command line followed by the creation of a possibly malicious child process. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
- Platform: Windows
- Severity: High
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1218, T1218.011