Command and Scripting Interpreter: rundll32 is a Windows execution technique that uses rundll32.exe to run code exported from a DLL. Attackers abuse it to launch malicious functions under a trusted system binary, which can bypass simple allowlists and make execution appear legitimate in process logs and command lines.
What the technique does
Rundll32 is a Windows command-line utility that can invoke exported code from a DLL. Security teams care about it because the binary is legitimate, widely present, and often trusted by users, logging systems, and application allowlists.
That trust is exactly what attackers try to borrow. When execution starts through a signed operating-system component, the resulting process tree can look routine even when the called DLL is malicious or the exported function is a wrapper for another payload.
Why rundll32 matters operationally
As a living-off-the-land technique, rundll32 sits in the gap between normal administration and malicious execution. It can support scriptless or low-noise activity, reduce the chance of simple file-name blocking, and make alert triage harder when defenders focus only on obvious malware binaries.
The technique also matters because command-line visibility is not enough by itself. A process can be visible in audit logs and still be operationally opaque if defenders do not inspect the DLL path, command-line arguments, parent process, and follow-on child processes.
How defenders detect suspicious rundll32 use
Detection should start with context, not just the process name. Unusual parent-child relationships, DLLs launched from user-writable locations, network-facing activity from a utility that should be administrative, and command lines that reference odd export names are all worth closer review.
Process creation telemetry and script or command auditing help most when they are tuned together. The strongest detections compare rundll32 activity against known-good baselines, because the same binary may be used legitimately by software installers, control panels, or vendor tooling.
For practical defensive guidance, T1059 Command and Scripting Interpreter Defensive Guide explains the interpreter family, telemetry to enable, and detections that hold up under abuse.
Controls that reduce abuse of trusted interpreters
The best control pattern is to shrink the set of places where rundll32 can be abused, rather than assuming the binary itself can be removed. Application control, constrained administrative paths, and careful allowlist design reduce the value of trusted utilities as execution proxies.
Endpoint hardening should also assume that signed binaries can be repurposed. If an organisation treats every Microsoft-signed executable as inherently safe, attackers can use rundll32 to blend into expected system activity while still launching malicious code.
Living off the Land Guide covers the broader LOLBin pattern, including detection and hardening approaches that also apply to rundll32 abuse.
Risk and Threat Considerations
Rundll32 abuse creates a practical execution-and-evasion risk because it lets attackers launch code through a trusted Windows binary instead of an obviously malicious executable. That lowers the chance of simple block rules succeeding and can delay discovery when defenders rely on process names more than on command-line and DLL provenance.
Failure mechanism: The attacker supplies a malicious DLL or export path, then uses rundll32 to execute it under a normal-looking process identity, often from a location or parent process that deserves scrutiny.
Impact: The resulting activity can enable payload delivery, persistence, lateral movement, or staged follow-on actions while making triage and containment slower.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Rundll32 is a command and scripting interpreter abuse pattern in ATT&CK. |
| Recommendation — Map rundll32 executions to T1059 and hunt for unusual command lines, parentage, and DLL paths. | ||
| NIST SP 800-53 Rev 5 | CM-7 — Least Functionality | Reducing executable abuse depends on limiting unnecessary interpreter and binary use. |
| AU-2 — Event Logging | The technique is best observed through process and command execution telemetry. | |
| Recommendation — Restrict where rundll32 can run and deny unneeded execution paths under CM-7. Log process creation and command-line detail so rundll32 abuse is visible for review. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Auditing interpreter use and command execution is central to spotting abuse patterns. |
| CIS-3 — Data Protection | Application control and trusted-binary abuse are reduced by tighter software execution governance. | |
| Recommendation — Centralise and review endpoint logs that expose rundll32 command lines and child processes. Apply software execution restrictions and allowlists to limit trusted-binary abuse. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org