CmdID / Techniques / T1218
T1218.011 System Binary Proxy Execution: Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. MITRE ATT&CK
15 programs on CmdID 34 Sigma rules T1218.011 on attack.mitre.org
Part of
T1218System Binary Proxy Execution
Programs for it
Sigma rules tagged with it
criticalAPT29 2018 Phishing Campaign CommandLine IndicatorsFlorian Roth (Nextron Systems), @41thexplorer · Windows
criticalEvilNum APT Golden Chickens Deployment Via OCX FilesFlorian Roth (Nextron Systems) · Windows
highBad Opsec Defaults Sacrificial Processes With Improper ArgumentsOleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems) · Windows
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows
highIcedID Malware Suspicious Single Digit DLL Execution Via Rundll32Nasreddine Bencherchali (Nextron Systems) · Windows
highKapeka Backdoor Execution Via RunDLL32.EXESwachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential PowerShell Execution Via DLLMarkus Neis, Nasreddine Bencherchali (Nextron Systems) · Windows
highSofacy Trojan Loader ActivityFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows
mediumPotentially Suspicious Rundll32 Activityjuju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumRundll32 Execution With Uncommon DLL ExtensionTim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou · Windows
mediumRundll32 InstallScreenSaver ExecutionChristopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec · Windows