The execution of rundll32.exe without command-line arguments is detected via endpoint telemetry, a behavior indicative of potential malicious activity such as Cobalt Strike, leading to arbitrary code execution and system compromise.
PoC
Windows Print Spooler
defense-evasion
windows
rundll32
2r
1t
1c
updated