Suspicious Remote DLL Load Through Rundll32.EXE (via image_load)

title: Suspicious Remote DLL Load Through Rundll32.EXE (via image_load)
id: 19e920b8-5353-5be3-9ac2-45b64c9ab6a4
status: stable
description: This rule detects a remote DLL load event via "rundll32.exe".
references:
    - https://attack.mitre.org/techniques/T1204/002/
    - https://github.com/gabe-k/themebleed
    - Internal Research
author: Huntrule Team
date: 2026-07-04
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        ImageLoaded|startswith: '\\\\'
    condition: selection
falsepositives:
    - Unknown
level: medium