Under certain conditions, particularly if you lack controls for blocking DLL loads, the execution of malicious code through Rundll32 can bypass application controls.īeyond DLLs, Rundll32 can also execute JavaScript via the RunHtmlApplication function.Īdversaries abuse Rundll32 in a wide variety of ways, so we’ll limit our focus to variations we encounter regularly.Īdversaries often leverage Rundll32 to load code from DLLs within world-writable directories (e.g., the Windows temp directory), a pattern of behavior that you might see from legitimate enterprise software as well as not-so-legit tools like Cobalt Strike.Īs we’ve covered on the Red Canary blog, adversaries use Rundll32 to load the legitimate comsvcs.dll, which calls the MiniDump function, allowing adversaries to dump the memory of certain processes. Additionally, adversaries are known to abuse export functionality in legitimate DLLs, including those that can facilitate connection to network resources to bypass proxies and evade detection. Executing malicious code as a DLL allows an adversary to keep their malware from appearing directly in a process tree, as a directly executed EXE would. This necessity and ubiquity makes Rundll32 an attractive target for adversaries intent on blending in.įrom a practical standpoint, Rundll32 enables the execution of native dynamic link libraries (DLL).

It is a functionally necessary component of the Windows operating system that can’t be simply blocked or disabled. Like many of the most prevalent ATT&CK techniques, Rundll32 is a native Windows process that’s installed by default on nearly every Microsoft computer dating back to Windows 95.

Three rundll32 exe running