Binary Proxy Execution via Rundll32

sequence with maxspan=1m
  [process where event.action == "start" and
   process.pe.original_file_name == "RUNDLL32.EXE" and
   process.command_line :
          ("*advpack*RegisterOCX*",
           "*advpack*#12*",
           "*zipfldr*RouteTheCall*",
           "*pcwutl*LaunchApplication*",
           "*pcwutl*#1*",
           "*url.dll*FileProtocolHandler*file://*",
           "*url.dll*FileProtocolHandler*.exe*",
           "*shell32.dll*ShellExec_RunDLL*",
           "*advpack*LaunchINFSection*",
           "*desk*InstallScreenSaver*",
           "*shell32*WaitForExplorerRestart*") and
   /* Issue #265 */
   not (process.command_line : "*url.dll*FileProtocolHandler*" and
        process.command_line : ("*http://*", "*zoommtg://*", "*://*&*&*")) and

   /* Legit LaunchApplication instances via msdt */
   not (process.command_line : "*pcwutl.dll,LaunchApplication*" and
        process.parent.name :  "msdt.exe" and
        process.working_directory : "?:\\Windows\\system32\\") and

   not (process.command_line :  "*shell32*WaitForExplorerRestart*" and process.args : "?:\\Windows\\*explorer.exe") and
   not (process.parent.executable : "C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe" and process.args : "ShellExec_RunDLL")
   ] by process.entity_id
  [process where event.action == "start" and
   not process.executable :
                ("?:\\Program Files\\*",
                 "?:\\Program Files (x86)\\*",
                 "C:\\Windows\\System32\\shutdown.exe",
                 "C:\\Windows\\System32\\WerFault.exe") and
   not (process.executable : "?:\\Windows\\*.scr" and process.parent.args : "desk.cpl,InstallScreenSaver") and
   not (process.name : "wscript.exe" and process.args : "Cathexis Archive Viewer.vbs") and
   not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
   not process.Ext.token.integrity_level_name == "system" and
   not process.executable : "?:\\Windows\\System32\\grpconv.exe" and
   not (process.code_signature.subject_name : "Adobe Inc." and process.code_signature.trusted == true) and
   not process.hash.sha256 :
                  ("f6bef3f879e082d115c2ad199a986da1660514699f5e752c7b628d9438d7cb49",
                   "c2831f5b010f099cd1733a0183adfa16cb834a9169fc55c6f7e6dc3267488c3f",
                   "70ebedc5aba37140682a0535eac9f1cfb77cc9916955e36f19ba1da893068a83",
                   "e6caed88fa115a412c744d0ec91f34cd3b5f329d7acdc1cb14e35364d492d095",
                   "af31ac74a9072e4bbc24ff17ee70681539e660d4fa885fcb45e752b5ec21d2ef") and
   not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.parent.args : "?:\\WINDOWS\\system32\\pcwutl.dll,LaunchApplication") and 
   not (process.executable : "?:\\Windows\\System32\\verclsid.exe" and process.args : "{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}" and process.parent.command_line : "*ShellExec_RunDLL*") and 
   not (process.executable : ("?:\\Windows\\System32\\notepad.exe", "?:\\Windows\\System32\\mspaint.exe") and process.parent.command_line : "*ShellExec_RunDLL*")
   ] by process.parent.entity_id