BIOC
Medium
✕
Suspicious DLL load using Control.exe
This execution mechanism is known to be used by malware to load malicious DLLs.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011) System Binary Proxy Execution: Control Panel (T1218.002)
Indicator:
Process action type = execution AND target process cmd != *Shell32.dll* AND target process name = rundll32.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process os parent name = control.exe Host host os != linux
Preventable: yes