Renamed rundll32 execution should be a critical alert that rises to the top of the SOC queue. Don't wait for correlation to trip, respond ASAP.🚨 Sigma Rule from @cyb3rops : github.com/SigmaHQ/sigma/blo…