T1218.011sub-technique of T1218 System Binary Proxy Execution
Rundll32
Windows1 piece on this siteT1218.011 on attack.mitre.org
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}`).
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Q3 detection rule pack: persistence and execution
Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
how MITRE says to see it
Detection Strategy for T1218.011 Rundll32 Abuse
- Detects rundll32.exe invoked with atypical arguments (.dll,.cpl, javascript:, mshtml). DLLs not normally loaded by rundll32 are mapped into memory. Control_RunDLL or RunHTMLApplication invoked. Suspicious DLLs or scripts accessed from disk or network.
what reduces it
- M1050 Exploit Protection. Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.