Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe can also be used to e...
BY SOURCE
PROCEDURES (53)
Auto-extracted: 6 detections for process creation monitoring
Auto-extracted: 4 detections for suspicious
Auto-extracted: 4 detections for script execution monitoring
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for network connection monitoring
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for credential