Windows Application Whitelisting Bypass via Rundll32

The rundll32.exe binary is a legitimate Windows system utility designed to run DLL-based programs. Threat actors frequently abuse this binary as a Living Off the Land (LotL) technique to bypass application whitelisting and execute arbitrary code. By invoking specific exported functions - namely "LaunchINFSection", "InstallHinfSection", or "SetupInfObjectInstallAction" - within libraries like Advpack.dll, Ieadvpack.dll, Syssetup.dll, or Setupapi.dll, an attacker can trigger the execution of script-based content contained within INF files. This activity is critical for detection engineers to monitor, as it often precedes more damaging actions such as secondary payload download, privilege escalation, or establishing persistence on a compromised Windows host. The technique is well-documented in the LOLBAS project and leveraged in various red team exercises to bypass security controls.

Impact

Successful exploitation allows attackers to execute arbitrary code under the context of the rundll32.exe process, potentially bypassing application control solutions. This can lead to full system compromise, including privilege escalation, sensitive data exfiltration, or the deployment of secondary malware. While the specific number of victims varies, this technique is a core component of many advanced persistent threat (APT) toolsets that target enterprise environments running Windows.

Recommendation

Detection engineering teams should prioritize visibility into process execution command lines to identify the use of the specified DLLs and function exports.

• Deploy the provided Sigma rule to detect suspicious rundll32 command-line arguments.
• Enable Sysmon Event ID 1 (Process Creation) or Windows Event ID 4688 to capture full command-line strings for monitoring.
• Establish a baseline of legitimate software (such as specialized DLP agents) that might utilize these DLLs to prevent false positives in the detection logic.
• Regularly audit systems for unexpected parent-child process relationships involving rundll32.exe.