T1218.011

Rundll32

What it is

Attackers use rundll32.exe, a signed Windows program that runs code stored in DLL files, to run their own code under a trusted name. It is a sub-technique of System Binary Proxy Execution. Because rundll32.exe is part of Windows and runs constantly for legitimate reasons, controls that trust signed system programs can let the attacker's code through.

How adversaries use it

The attacker drops a DLL on the host and runs it with rundll32.exe, naming the DLL and the function to call. The DLL often sits in a user-writable folder, has a misleading name, or is called by number instead of by function name. Some attackers start rundll32.exe with no arguments at all and inject code into it, so the process looks empty.

Detect it in Elastic

Data source: Windows process creation events (Sysmon and Windows Security)

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) when a process starts process.name: rundll32.exe process.command_line: the DLL path and the function or number called process.parent.name: what started it user.name: the account it ran as host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-307.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "rundll32.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "rundll32.exe E:\\Depot\\hlp.dll,SvcLoad"
  },
  "@timestamp": "2026-06-02T14:44:03.271Z"
}

Prebuilt Elastic rule: Unusual Child Processes of RunDLL32

Hunt guidance

Start with every rundll32.exe start and read its command lines: process.name: "rundll32.exe". Then read the DLL path in each command line and set aside DLLs under the Windows folders, which are routine. Look for DLLs in user-writable or removable locations, functions called by number, no arguments at all, a script host or document as the parent, and network connections made by rundll32.exe soon after it starts.

Ruling out legitimate activity

Windows itself, control panel items, printers and many installed applications use rundll32.exe all day, usually with DLLs under the Windows folder and well-known function names. Compare the DLL's location, the parent and the account with what the host normally runs. A DLL in a user folder started by a script host is rarely legitimate.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

Sysmon
- 1 Process creation
- 11 FileCreate
- 22 DNSEvent (DNS query)
- 3 Network connection
- 7 Image loaded

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.