Rundll32 LOLBin proxy
A signed Microsoft DLL invoked through its documented export purely to launch something else.
What it detects
A signed Microsoft DLL invoked through its documented export purely to launch something else. Each dll,Export pair below takes a path or URL and runs it, so the attacker's binary never appears as the process image — the parent is rundll32.exe, and application-control policies that trust signed Microsoft code let it through.
Matching is on the dll,Export pair rather than the process name, which is deliberate: the pair is meaningless in any other context, and keying on it also catches a RENAMED rundll32, which a process-name rule would miss entirely.
MITRE ATT&CK mapping
- T1218.011System Binary Proxy Execution: Rundll32· Defense Evasion
False positives and triage
These exports are not used by ordinary software; the closest legitimate case is an installer calling advpack/setupapi INF sections during a genuine setup, which arrives with an installer as the parent process and an INF under a vendor directory.
To confirm: read the argument after the export — it is the thing being launched. A URL, or a path under \Users\, \Temp\, \ProgramData\ or a network share, is the finding. comsvcs.dll,MiniDump is a special case: it targets a PID, and if that PID is lsass.exe this is credential theft, not proxy execution — treat it as critical and check for a dump file written nearby.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/rundll32_lolbin_proxy.yaml, licensed under the Apache License 2.0.
id: windows.execution.rundll32_lolbin_proxy
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1218.011]
description: |
A signed Microsoft DLL invoked through its documented export purely to launch
something else. Each `dll,Export` pair below takes a path or URL and runs it, so
the attacker's binary never appears as the process image — the parent is
`rundll32.exe`, and application-control policies that trust signed Microsoft code
let it through.
Matching is on the `dll,Export` pair rather than the process name, which is
deliberate: the pair is meaningless in any other context, and keying on it also
catches a RENAMED rundll32, which a process-name rule would miss entirely.
match:
command_line_contains_any:
- 'advpack.dll,RegisterOCX'
- 'advpack.dll,LaunchINFSection'
- 'ieadvpack.dll,RegisterOCX'
- 'ieadvpack.dll,LaunchINFSection'
- 'zipfldr.dll,RouteTheCall'
- 'shdocvw.dll,OpenURL'
- 'ieframe.dll,OpenURL'
- 'pcwutl.dll,LaunchApplication'
- 'url.dll,FileProtocolHandler'
- 'url.dll,OpenURL'
- 'shell32.dll,ShellExec_RunDLL'
- 'syssetup.dll,SetupInfObjectInstallAction'
- 'setupapi.dll,InstallHinfSection'
- 'dfshim.dll,ShOpenVerbApplication'
- 'comsvcs.dll,MiniDump'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
These exports are not used by ordinary software; the closest legitimate case is an
installer calling `advpack`/`setupapi` INF sections during a genuine setup, which
arrives with an installer as the parent process and an INF under a vendor directory.
To confirm: read the argument after the export — it is the thing being launched.
A URL, or a path under `\Users\`, `\Temp\`, `\ProgramData\` or a network share, is
the finding. `comsvcs.dll,MiniDump` is a special case: it targets a PID, and if
that PID is lsass.exe this is credential theft, not proxy execution — treat it as
critical and check for a dump file written nearby.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.