rundll32.exe

Overview

rundll32.exe is a built-in Windows utility used to load and execute functions exported from DLL files.

It exists to allow Windows components, many of which ship as DLLs, to run small pieces of functionality without needing full standalone executables. rundll32.exe acts as a simple wrapper for DLLs, as they’re not directly executable.

rundll32.exe <dll>,<exported_function> [arguments]

Expected Characteristics

Expected Location

Expected Parent

Typical Profile

Why This Matters

rundll32.exe appears frequently in triage because it is a flexible execution mechanism. Legitimate use does exist, but malicious use is more common, especially for execution, persistence, and lateral movement.

Common adversary use cases include:

Investigation Objective

Determine whether the DLL loaded by rundll32.exe is:

Particular attention should be paid to DLLs loaded from user-writable locations or newly-created paths.

Normal Behaviour

Characteristics

Path

Signature

Parents

Command Line

Children

Typical Activity

Abuse Patterns

Path or Signature Mismatch

Investigate:

Examples:

rundII32.exe

run32dll.exe

DLL Path Anomalies

Investigate DLLs loaded from:

Additional concerns include:

Suspicious Export Functions

Investigate exports such as:

Start

EntryPoint

Main

Windows components usually use predictable export names.

Unexpected Parent Processes

Investigate rundll32.exe launched by:

Suspicious Command Line Patterns

Look for:

Common example:

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication"

Also investigate:

Child Process Anomalies

Investigate child processes such as:

powershell.exe

cmd.exe

mshta.exe

wscript.exe

Any unusual or unsigned child processes should be investigated.

Detection Opportunities

Process Ancestry

The parent process is often one of the strongest indicators available.

Investigate rundll32.exe when launched by:

These relationships are far less common than Control Panel applets, system utilities, or enterprise management tooling launching rundll32.exe.

DLL Path Analytics

The DLL being loaded is often more important than rundll32.exe itself.

Investigate DLLs loaded from:

Additional indicators include:

Command-Line Analytics

Focus on the command line supplied to rundll32.exe.

Common indicators include:

Example:

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication"

Although some legitimate software uses unusual command lines, rare command lines generally warrant investigation.

Child Process Indicators

rundll32.exe typically loads a DLL and exits without creating additional processes.

Investigate child processes such as:

powershell.exe

cmd.exe

mshta.exe

wscript.exe

cscript.exe

Particular attention should be paid to scripting engines and LOLBins appearing immediately after rundll32.exe execution.

Correlated Activity

A single rundll32.exe event rarely provides enough context on its own.

Review surrounding activity, including:

The highest-confidence detections usually come from combining rundll32.exe activity with one or more additional suspicious events.

Hunting Opportunities

Useful hunting approaches include:

Focus on behaviours that are uncommon in your own environment rather than relying purely on static detection rules.

False Positives

Although rundll32.exe is heavily abused, genuine cases exist, especially in environments with legacy applications or enterprise OEM utilities.

Common Legitimate Scenarios

Validation Questions

Check:

Hardening Recommendations

Application Control

Application allow-listing is one of the most effective mitigations for rundll32.exe abuse.

Consider:

The objective is not to block rundll32.exe itself, but to prevent unapproved DLLs from being executed.

Restrict User-Writable Execution Paths

Adversaries frequently store payloads in locations where standard users can write files.

Review execution controls for:

Reducing execution opportunities in these locations can significantly increase attacker workload.

Attack Surface Reduction Rules

Where Microsoft Defender is available, Attack Surface Reduction (ASR) rules can help reduce common payload execution techniques.

Particularly relevant controls include:

ASR rules should be evaluated carefully to understand operational impact before broad deployment.

Monitoring and Alerting

Monitoring should focus on behaviour rather than the mere presence of rundll32.exe.

Recommended telemetry includes:

Alerting on every rundll32.exe execution will generate excessive noise.

Alerting on unusual rundll32.exe behaviour is significantly more effective.

Administrative Hygiene

Review legitimate uses of rundll32.exe within the environment.

Questions to consider:

Reducing legitimate but unnecessary rundll32.exe usage improves signal-to-noise ratio and makes malicious activity easier to identify.

Defensive Validation

Where possible, validate detections and controls using controlled testing.

Examples include:

Controls should be assessed based on their ability to identify realistic abuse rather than simple proof-of-concept execution.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

DLL Context

Scope

ATT&CK References

Windows Processes

MITRE ATT&CK

Updated: