T1218.011 — Rundll32

Tactic: Stealth · Platforms: Windows

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.011 System Binary Proxy Execution: Rundll32 - File Dropped by Rundll32

title: "T1218.011 System Binary Proxy Execution: Rundll32 - File Dropped by Rundll32"
id: 60c29d28-216b-4d92-a2ac-73cb7459bf0e
description: 'Detects rundll32.exe writing an executable/library/dump file to disk outside common install/system directories — broad and noisy on its own, intended as a corroborating signal alongside the module-load and command-line rules for this technique.'
references:
  - https://attack.mitre.org/techniques/T1218/011/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.stealth
  - attack.t1218.011

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\rundll32.exe'

  suspicious:
    TargetFilename|endswith:
      - '.dll'
      - '.exe'
      - '.dmp'

  filter_legit_paths:
    TargetFilename|contains:
      - ':\Windows\System32\'
      - ':\Windows\SysWOW64\'
      - ':\Windows\WinSxS\'
      - ':\Windows\Installer\'
      - ':\Program Files\'
      - ':\Program Files (x86)\'

  condition: selection and suspicious and not filter_legit_paths

falsepositives:
  - Legitimate installers or Control Panel applets invoked via rundll32 that write files to non-standard but still benign user-writable paths.

level: low

Related sub-techniques

Explore