Rundll32.exe loads a DLL and calls a function inside it. It is a normal part of Windows and runs constantly. MITRE ATT&CK tracks its abuse as T1218.011, Rundll32, a System Binary Proxy Execution sub-technique in the Stealth tactic. The platform is Windows.
How attackers use it
MITRE explains that running code through rundll32.exe, instead of running it directly, may avoid triggering security tools that do not monitor the process because of allow lists or false positives from normal operations. The common form is a DLL name and a function name passed as arguments.
The MITRE page documents several other forms:
- Control Panel items (.cpl files) can be run through undocumented shell32.dll functions. Double clicking a .cpl file also causes rundll32.exe to run. ClickOnce can be proxied through rundll32 as well.
- Rundll32 can run scripts such as JavaScript, using a syntax that hands control to the HTML application host and loads a remote scriptlet. MITRE says this behavior has been seen in the malware Poweliks.
- Adversaries may abuse legitimate, signed system DLLs with rundll32.exe to run programs or scripts indirectly, which makes the activity look more legitimate.
- Adversaries may also hide malicious code from analysis by abusing how rundll32 resolves DLL function names. Because of character set compatibility support, rundll32 checks for wide (Unicode) and then ANSI versions of a function name before loading the specified function.
Why this one is noisy
Nearly every Windows machine runs rundll32 dozens of times a day. A rule that fires on every launch is useless. A rule that fires on none is blind. The work is in the middle.
How to detect it
The MITRE strategy looks for rundll32.exe invoked with atypical arguments, such as a .dll, a .cpl, a javascript protocol or the mshtml library. It also looks for DLLs not normally loaded by rundll32 appearing in memory, calls to Control_RunDLL or RunHTMLApplication, suspicious DLLs or scripts accessed from disk or the network, and rundll32 reaching out to external domains to fetch scriptlets or HTA files.
Sort that into data you can collect:
- Process creation with command lines (Sysmon event ID 1 or Security event 4688).
- Network connections from rundll32.exe (Sysmon event ID 3). Most runs have none, so any external connection is a strong signal.
- Image loads (Sysmon event ID 7), to see which DLLs get mapped.
- Parent process. Rundll32 started from Office applications, script hosts or a browser deserves attention.
Tuning
- Alert on rundll32 command lines containing URLs or script protocols.
- Alert on DLL paths under user profile, temp or public folders.
- Alert on rundll32 launched with no arguments at all, or with arguments that do not name a DLL and function in the usual form.
- Keep an allow list of the DLL and function pairs that your own software and Windows use, and review new entries.
How to reduce the risk
MITRE lists exploit protection. Attack Surface Reduction features can block methods of using rundll32.exe to bypass application control. Beyond that, the same fundamentals apply as for any system binary:
- Use application control to restrict which DLLs can load, rather than trying to ban rundll32.exe itself, which Windows relies on.
- Restrict outbound traffic from rundll32.exe at the host firewall.
- Collect telemetry that records rundll32 command lines and network behavior.
Check your own environment
- Do you log command lines for process creation on every Windows host?
- Does anything in your detection stack alert on rundll32 reaching the internet?
- Is application control enforced for DLLs, or only for executables?
- Can you identify the parent process for every rundll32 launch in the last week?
This read-only PowerShell command lists recent Security log process creation events mentioning rundll32 with a URL, if command line auditing is on:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1000 | Where-Object { $_.Message -match 'rundll32' -and $_.Message -match 'http' } | Select-Object TimeCreated, Message
An empty result is the healthy answer.
What good looks like
Since you cannot ban rundll32, good means a precise rule set. You know the DLL and function pairs your software uses. You alert on URLs, script protocols and user writable paths. You alert on external network connections from the process. And you can answer, for any launch in the past week, which parent started it. That level of visibility turns a noisy tool into a clear signal.
Quick check
Why is blocking rundll32.exe usually not an option?
Windows and many applications rely on it, so controls usually focus on what it loads and where it connects, not on banning it.
What does Control_RunDLL have to do with this technique?
It is an undocumented shell32.dll function that rundll32 can use to run Control Panel items (.cpl files).
Which network behavior from rundll32.exe is worth alerting on?
Connections to external domains, especially ones fetching scriptlets or HTA files.
Sources
- MITRE ATT&CK, T1218.011: https://attack.mitre.org/techniques/T1218/011
