T1055 Process Injection: Rundll32 Spawning Explorer as an Injection Host

A rundll32.exe process spawning explorer.exe. Observed as the injection stage of a ClickFix-delivered loader: rundll32 runs the staged DLL (rundll32 <dll>,Run), which starts a fresh SysWOW64\explorer.exe purely as an injection host and writes its next stage into that process memory. explorer.exe is normally launched by userinit.exe or winlogon.exe at logon, not by rundll32; a rundll32 parent is anomalous and, in the observed chain, the injected explorer then loaded and side-loaded the final payload and beaconed out: which is why Joe Sandbox surfaces this exact parent-child edge. The SysWOW64 (32-bit) path is a further signal: the loader is WOW64 and spawns the 32-bit explorer to host 32-bit injected code before transitioning to 64-bit. This rule does not see the memory write itself; it anchors on the process lineage, which is durable across the operator payload rotation (contract addresses, DLL names and hashes all rotate; the injection shape does not).

Rule ID

38e8d903-8fa4-50f8-bd0d-95e7321f92cd

Status

experimental

Level

high

Log source

category: process_creation · product: windows

Date

2026-08-14

Modified

2026-08-14

ATT&CK

T1055 , T1218.011 (signal rollup)

Canonical YAML

t1055-rundll32-spawning-explorer-injection.yml

References

• https://thrunt.me/research/2026-08-11-etherhiding-onchain-conversion-registry/
• https://attack.mitre.org/techniques/T1055/
• https://attack.mitre.org/techniques/T1218/011/

False positives

• Rare administrative or scripted use of rundll32 that legitimately relaunches the shell. Uncommon; baseline before promoting past experimental and allowlist the specific parent command line if found.
• Some software installers shell out through rundll32 in ways that can touch explorer; confirm the rundll32 command line does not reference a user-writable DLL path before dismissing.

Rule YAML

title: 'T1055 Process Injection: Rundll32 Spawning Explorer as an Injection Host'
id: '38e8d903-8fa4-50f8-bd0d-95e7321f92cd'
status: 'experimental'
description: 'A rundll32.exe process spawning explorer.exe. Observed as the injection stage of a ClickFix-delivered loader: rundll32 runs the staged DLL (rundll32 <dll>,Run), which starts a fresh SysWOW64\explorer.exe purely as an injection host and writes its next stage into that process memory. explorer.exe is normally launched by userinit.exe or winlogon.exe at logon, not by rundll32; a rundll32 parent is anomalous and, in the observed chain, the injected explorer then loaded and side-loaded the final payload and beaconed out: which is why Joe Sandbox surfaces this exact parent-child edge. The SysWOW64 (32-bit) path is a further signal: the loader is WOW64 and spawns the 32-bit explorer to host 32-bit injected code before transitioning to 64-bit. This rule does not see the memory write itself; it anchors on the process lineage, which is durable across the operator payload rotation (contract addresses, DLL names and hashes all rotate; the injection shape does not).'
references:
    - 'https://thrunt.me/research/2026-08-11-etherhiding-onchain-conversion-registry/'
    - 'https://attack.mitre.org/techniques/T1055/'
    - 'https://attack.mitre.org/techniques/T1218/011/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-14'
modified: '2026-08-14'
tags:
    - 'attack.defense_evasion'
    - 'attack.privilege_escalation'
    - 'attack.t1055'
    - 'attack.t1218.011'
    - 'tlp.clear'
logsource:
    category: 'process_creation'
    product: 'windows'
detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith: '\explorer.exe'
    filter_shell_restart:
        # A genuine shell relaunch is parented by explorer/userinit, not rundll32,
        # so it never matches selection; this filter covers the case where a
        # monitored explorer restart is misattributed, and is scoped narrowly.
        ParentImage|endswith:
            - '\userinit.exe'
            - '\winlogon.exe'
            - '\explorer.exe'
    condition: 'selection and not filter_shell_restart'
falsepositives:
    - 'Rare administrative or scripted use of rundll32 that legitimately relaunches the shell. Uncommon; baseline before promoting past experimental and allowlist the specific parent command line if found.'
    - 'Some software installers shell out through rundll32 in ways that can touch explorer; confirm the rundll32 command line does not reference a user-writable DLL path before dismissing.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1055-rundll32-spawning-explorer-injection.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.