LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Shdocvw.dll

View source

Shell Doc Object and Control Library.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218.011

Launch an executable payload via proxy through a URL (information) file by calling OpenURL.

COMMAND
rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}
USE CASE
Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · URL
02 / ON DISK

Known paths

c:\windows\system32\shdocvw.dll
c:\windows\syswow64\shdocvw.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@hexacorn
Jimmy@bohops