LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Shell32.dll

View source

Windows Shell Common Dll

Execute
04COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

Execute4

EXAMPLE 01T1218.011

Launch a DLL payload by calling the Control_RunDLL function.

COMMAND
rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}
USE CASE
Load a DLL payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLL
EXAMPLE 02T1218.011

Launch an executable by calling the ShellExec_RunDLL function.

COMMAND
rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}
USE CASE
Run an executable payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
EXAMPLE 03T1218.011

Launch command line by calling the ShellExec_RunDLL function.

COMMAND
rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}
USE CASE
Run an executable payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 04T1218.011

Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.

COMMAND
rundll32.exe shell32.dll,#44 {PATH:.dll}
USE CASE
Load a DLL/CPL payload.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

c:\windows\system32\shell32.dll
c:\windows\syswow64\shell32.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam (Control_RunDLL, Control_RunDLLNoFallback)@hexacorn
Pierre-Alexandre Braeken (ShellExec_RunDLL)@pabraeken
Matt Graeber (ShellExec_RunDLL)@mattifestation
Kyle Hanslovan (ShellExec_RunDLL)@KyleHanslovan