title: Suspicious Rundll32 Execution

id: c7b35acf-1122-4446-8d2d-95e7883f1064

status: experimental

description: >

  Detects rundll32.exe invoked in patterns associated with proxy execution of malicious

  code: no DLL argument, javascript: protocol handlers, or execution from user-writable paths.

references:

  - https://attack.mitre.org/techniques/T1218/011/

  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/

author: Zion Boggan

date: 2026-05-13

tags:

  - attack.defense_evasion

  - attack.t1218.011

logsource:

  product: windows

  category: process_creation

detection:

  selection_img:

    Image|endswith: '\rundll32.exe'

  selection_patterns:

    CommandLine|contains:

      - 'javascript:'

      - 'mshtml,RunHTMLApplication'

      - '.dll,#1'

      - '\AppData\'

      - '\Temp\'

      - '\ProgramData\'

  selection_nodll:

    CommandLine|re: 'rundll32(\.exe)?["'']?\s*$'

  condition: selection_img and (selection_patterns or selection_nodll)

falsepositives:

  - Rare legitimate use; baseline expected DLL invocations.

level: high