Skip to content
Threat Feed

Tag

Rundll32

3 briefs RSS
low advisory

Command Shell Activity Started via RunDLL32

This rule detects command shell activity, such as cmd.exe or powershell.exe, initiated by RunDLL32, a technique commonly abused by attackers to execute malicious code and bypass security controls.

M365 Defender +2 execution command-shell rundll32
2r 4t
high advisory

Rundll32 Execution with DLL Stored in Alternate Data Stream (ADS)

Adversaries may use rundll32.exe to execute DLLs stored within alternate data streams (ADS) to bypass security controls and conceal malicious code.

defense-evasion ads rundll32 windows
2r 1t
high advisory

Unusual Child Processes of RunDLL32 Execution Without Arguments

The execution of `rundll32.exe` without arguments, followed by a child process execution, indicates potential abuse of Rundll32 for proxy execution or payload handoff, often employed for defense evasion on Windows systems.

Elastic Defend defense-evasion proxy-execution rundll32
2r 1t