T1218.011 Rundll32: Detection Queries and Response

Rundll32.exe runs on every Windows endpoint many times a day, so a detection that simply flags "rundll32 ran" is useless, and one that ignores it misses one of the most used proxy execution paths in real intrusions. MITRE ATT&CK T1218.011 Rundll32 sits under System Binary Proxy Execution in the Stealth tactic, and ATT&CK v20 links it to 26 groups and 69 software entries, more than any other T1218 sub-technique. This guide is the detection engineering companion to the T1218 System Binary Proxy Execution Defensive Guide: it does not repeat the overview of proxy binaries, and instead covers how to baseline rundll32 in your estate, the command-line, parent-child, module-load and network patterns that separate abuse from normal use, sample detection logic you can port to your SIEM or EDR query language, and how to respond when an alert fires. It is written for detection engineers, threat hunters and SOC leads, and contains no attack procedures.

Key takeaways

Baseline first, alert second. Windows and many legitimate applications call rundll32 constantly; a per-estate list of normal DLL and export pairs is the foundation of every useful rule.
Four signal families carry the detection. ATT&CK's DET0475 strategy uses Sysmon events 1 (process creation), 7 (image loaded), 11 (file created) and 3 and 22 (network and DNS), and the strongest rules combine at least two of them.
Location and network beat names. A DLL loaded from a user-writable path, a non-DLL extension, or any connection from rundll32 to a public address is far more telling than any single command-line string.
Rundll32 is also a post-exploitation tool. ATT&CK records groups using it to call the comsvcs.dll MiniDump export against LSASS, so a rundll32 alert can mean credential theft as well as initial execution.
You cannot block it, so constrain it. Rundll32 is not on Microsoft's App Control recommended block list; control the DLLs it may load, the parents that may start it and the destinations it may reach.

Why rundll32 needs its own detection model

Microsoft documents rundll32 as the command that loads and runs 32-bit DLLs, and notes it can only call functions in a DLL written to be called by Rundll32. In practice the binary (in C:\Windows\System32 and C:\Windows\SysWOW64) hosts Control Panel items, printer dialogues, shell features and many third-party installers. ATT&CK's description of T1218.011 highlights what makes it different from other proxy binaries:

Any export, any DLL: the binary takes a DLL path and an export name, so the payload is the DLL, not rundll32. Process creation alone shows only the request; the image load shows what actually ran.
Script and Control Panel paths: rundll32 can run .cpl files through shell32 exports and can be pointed at script protocols through mshtml, which is why ATT&CK's analytic lists javascript:, mshtml, Control_RunDLL and RunHTMLApplication as atypical arguments. Control Panel abuse has its own sub-technique, T1218.002.
Signed system DLLs as intermediaries: ATT&CK notes legitimate DLLs such as zipfldr.dll and ieframe.dll being called to launch other content, which makes the visible DLL look benign.
Renaming: ATT&CK records Daggerfly proxying DLLs through a renamed copy of rundll32, which is T1036.003 Rename Legitimate Utilities layered on top. See the T1036 Masquerading Defensive Guide.

Rundll32 abuse shows up across the kill chain. ATT&CK lists TA551 and TA505 loading malicious DLLs after phishing, the Water Curupira campaign running the final Pikabot payload, Storm-0501 and the C0021 campaign launching Cobalt Strike Beacon loaders, Wizard Spider deploying ransomware commands over WebDAV, and Magic Hound and UNC3886 calling the comsvcs.dll MiniDump export to dump LSASS memory (T1003.001). The loader families covered in the Latrodectus and Bumblebee Loaders Guide are typical of the initial access end of this range.

Telemetry you need before writing rules

Most rundll32 detections fail because the data is missing, not because the logic is wrong. Check coverage for each source below before building analytics.

Source	Event	Fields that matter for rundll32	Collection notes
Sysmon	1 Process creation	Image, OriginalFileName, CommandLine, ParentImage, ParentCommandLine, User, IntegrityLevel, Hashes	On by default once Sysmon is installed; ProcessGuid allows correlation with other events
Sysmon	7 Image loaded	ImageLoaded path, Signed, Signature, SignatureStatus, Hashes	Off by default and high volume; include rules scoped to rundll32 as the loading image
Sysmon	3 Network connection	DestinationIp, DestinationPort, DestinationHostname, Initiated	Off by default; enable at least for rundll32 and other proxy binaries
Sysmon	22 DNS query	QueryName, QueryResults, Image	Not available on Windows 7 and earlier
Sysmon	10 Process access	SourceImage, TargetImage, GrantedAccess, CallTrace	Needed for the comsvcs.dll LSASS dump pattern
Windows Security	4688 Process creation	New process name, command line, creator process	Command line logging must be turned on through Group Policy; no module or network data
Microsoft Defender	1121, 1122 (Windows Defender/Operational)	ASR rule ID, path, process	1121 is a block, 1122 an audit event, 1129 a user override in warn mode

EDR platforms expose equivalent process, image load and network tables under their own names. See the Sysmon Guide for configuration and the EDR Telemetry Guide for mapping vendor schemas to these fields.

Baselining normal rundll32 activity

ATT&CK's DET0475 analytic (AN1308) lists four tuning elements: a time window for correlating invocation with module load or network activity, a parent process filter, an allowed DLL list and an external IP range. Build those from your own data before alerting.

Collect 14 to 30 days of process creation for rundll32 across a representative sample: standard user laptops, developer machines, servers and VDI.
Normalise the command line into three fields: DLL path, export or ordinal, and remaining arguments. Lower-case paths and expand environment variables so %windir% and C:\Windows match.
Group by DLL path, export and parent image. Expect a short head of high-volume pairs (shell32, printui, scheduled maintenance tasks, setupapi) and a long tail.
Classify the tail with the application owners: signed vendor DLLs in Program Files called by their own updaters go on the allow list with the publisher, path and export, never the DLL name alone.
Record normal network behaviour. On most user devices rundll32 should make few or no external connections; note the exceptions and their destinations.
Store the baseline as a lookup in the SIEM, with an owner and a review date, so rules reference one list rather than hard-coded exclusions.

Detection patterns and sample logic

The patterns below are written as vendor-neutral pseudo-queries over Sysmon field names. Port them to KQL, SPL, EQL or Sigma, and match on OriginalFileName equal to RUNDLL32.EXE as well as the image path so renamed copies are included. The Sigma Rules Guide covers conversion. The SigmaHQ repository already contains community rules for several of these patterns, including "Rundll32 Internet Connection" and "Potentially Suspicious Rundll32 Activity", which list the specific DLL and export pairs that have been abused.

Pattern	Signal	Sample logic (pseudo-query)	Typical false positives
1. DLL from user-writable location	Sysmon 1	process = rundll32 AND dll_path matches (\Users\, \ProgramData\, \Windows\Temp\, \AppData\, \Public\*) AND (dll_path, export) NOT IN baseline	Per-user installed applications and their updaters; add them by publisher
2. Non-DLL extension	Sysmon 1	process = rundll32 AND dll_path extension NOT IN (.dll, .cpl, .ocx) OR extension IN (.dat, .tmp, .png, .jpg, .sys, .log)	Rare; SigmaHQ has a rule for .sys files linked to the SolarWinds intrusion
3. Remote or UNC load	Sysmon 1, 3	process = rundll32 AND dll_path starts with \\ OR command line contains a URL	Software distribution shares; scope to known file servers
4. Script protocol arguments	Sysmon 1	process = rundll32 AND command line contains any of (javascript:, vbscript:, mshtml, RunHTMLApplication)	Very rare; alert at high severity
5. Suspicious parent	Sysmon 1	process = rundll32 AND parent IN (winword, excel, powerpnt, outlook, onenote, mshta, wscript, cscript, powershell, browsers, archive tools)	Some add-ins and print workflows; baseline per parent
6. Ordinal or empty export	Sysmon 1	process = rundll32 AND (export matches #[0-9]+ OR no arguments)	Some legitimate DLLs use ordinals; SigmaHQ flags an argument-less rundll32 as high severity
7. Outbound network	Sysmon 3, 22	process = rundll32 AND Initiated = true AND destination NOT IN private ranges AND destination NOT IN baseline	Update tasks to vendor clouds; the SigmaHQ rule filters selected Microsoft ranges
8. Unsigned module load	Sysmon 7	loading image = rundll32 AND (Signed = false OR SignatureStatus != Valid) AND ImageLoaded NOT under \Windows\	In-house tools; sign them or allow by hash
9. LSASS access	Sysmon 10	SourceImage = rundll32 AND TargetImage = lsass.exe AND CallTrace contains comsvcs.dll	None expected; treat as confirmed credential access
10. Rundll32 spawning children	Sysmon 1	parent = rundll32 AND child IN (cmd, powershell, wscript, mshta, net, whoami, nltest)	Control Panel items opening tools; baseline

Correlation rules worth building

Download, then load: Sysmon 11 file created by a browser, mail client or archive tool in a user path, followed within ten minutes by rundll32 loading that same path (Sysmon 1 or 7). This catches the common phishing chain without relying on file names.
Load, then beacon: rundll32 with a non-baseline DLL (pattern 1 or 8) followed within 60 seconds by an external connection or DNS query (pattern 7). This mirrors the TimeWindow element in ATT&CK's analytic.
Persistence pairing: a Run key or scheduled task value that names rundll32 and a user-path DLL. ATT&CK records MuddyWater malware using rundll32 in a Registry Run key. Pair Sysmon 13 on Run keys with pattern 1.
Dump file creation: pattern 9, or rundll32 creating a .dmp file (Sysmon 11), should trigger the credential compromise playbook immediately. See the Credential Dumping Guide.

Prevention and constraint controls

Microsoft's App Control for Business recommended block list names mshta.exe, wmic.exe, cscript.exe, wscript.exe and others, but not rundll32.exe, because Windows depends on it. Prevention therefore means limiting what rundll32 can do.

Control	What it constrains	Patterns it reduces	Trade-off
App Control or AppLocker with DLL rules	Which DLLs any process, including rundll32, may load; user-mode code integrity covers DLLs	1, 2, 8	DLL enforcement needs careful audit-mode testing; start with servers and kiosks
ASR "Block all Office applications from creating child processes" (d4f940ab-401b-4efc-aadc-ad5f3c50688a)	Office parents starting rundll32	5	Some add-ins break; audit first and add exclusions
ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" (01443614-cd74-433a-b99e-2ecdc07bfc25)	Newly dropped, rare executables	Download-then-load chains	Requires cloud-delivered protection; no warn mode
ASR "Block credential stealing from the Windows local security authority subsystem" (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2), or LSA protection and Credential Guard	Access to LSASS memory	9	Microsoft notes the rule is not needed where LSA protection and Credential Guard are enabled
ASR "Block use of copied or impersonated system tools" (c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb)	Copies of System32 binaries run from other locations	Renamed or relocated rundll32	Generic to all system tools, not rundll32 specific
Host firewall egress rule	Outbound connections from rundll32 on user devices	3, 7	Breaks any legitimate update task that uses rundll32; baseline first
Disable the WebClient service where unused	WebDAV loading of remote DLLs	3	Affects SharePoint and WebDAV mapped drives

For the wider allowlisting decision, see the Application Allowlisting Guide; for the full living-off-the-land picture, the Living off the Land Guide.

Rolling out rundll32 detections

Weeks 1 to 2, telemetry: confirm Sysmon 1, 3, 7 (scoped to rundll32), 10 and 22, or EDR equivalents, arrive from at least 95 percent of endpoints. Turn on 4688 command line logging as a fallback.
Weeks 2 to 4, baseline: build the DLL, export and parent lookup described above and agree owners for each exception.
Weeks 4 to 6, high-fidelity rules live: patterns 4, 9 and the download-then-load correlation alert to the SOC; they have few false positives.
Weeks 6 to 10, tuned rules: patterns 1, 2, 5, 7 and 8 run as hunting queries or low-severity alerts for two weeks, then move to alerting once the false positive rate is acceptable.
In parallel, prevention: deploy the ASR rules in audit mode (event 1122), review for two weeks, then block (event 1121) ring by ring. Microsoft advises using exclusions rather than reverting a rule to audit.
Rollback: each rule and ASR setting has a named owner and a documented disable path; if a business process breaks, add a scoped exclusion and record it in the baseline lookup rather than switching the control off.

Small and large estates: a small organisation without a SIEM can still use EDR custom detections for patterns 4, 7 and 9 and the ASR rules, which cover most of the risk. Large estates with many line-of-business applications should invest in the baseline lookup and treat patterns 1 and 8 as the main analytics, because hard-coded exclusions do not scale.

Responding to a rundll32 alert

Triage starts from the DLL, not the process. Work through these questions in order:

What DLL and export ran? Pull the image load event, the file hash and signature status, and check the file's creation event to find what wrote it.
What started rundll32? Walk the parent chain back to the user action or service: an email attachment, a browser download, an LNK file, a scheduled task or a remote service creation (T1569.002) all change the scope.
Did it talk to anything? DNS and network events from the rundll32 process and its children give the first indicators to block.
Did it touch LSASS or create a .dmp file? If yes, treat every credential used on that host since the last reboot as compromised, including service accounts and cached admin credentials.
Is it persistent? Check Run keys, scheduled tasks and services that reference the DLL path.

Containment: isolate the host through EDR, block the DLL hash and any contacted domains, and disable the user session. Evidence to keep: the DLL file, the process tree, the Sysmon or EDR events for the window, and any memory capture taken before reboot. Eradication: remove persistence entries, reset exposed credentials and search the estate for the same hash, path pattern and destination.

Where identity fits

Rundll32 runs with the token of whoever starts it, so the blast radius is set by identity. A DLL loaded under a local administrator or a service account can reach LSASS, and the comsvcs.dll MiniDump pattern exists precisely to harvest the credentials of other users and machine accounts that have logged on to the host. Removing standing local admin rights, using unique local administrator passwords per device and keeping privileged and service account logons off user endpoints limit what a successful rundll32 execution can steal. See the T1003 OS Credential Dumping guide for the credential side.

Measuring detection quality

Telemetry coverage: percentage of Windows endpoints sending process creation with command line and rundll32-scoped image load events in the last 24 hours. Target above 95 percent.
Alert precision: true positives divided by total alerts per pattern, tracked monthly; retire or rework any pattern below an agreed threshold.
Test pass rate: percentage of scheduled purple team or atomic tests for T1218.011 that raised the expected alert within the SLA.
ASR enforcement: percentage of devices with the four ASR rules above in block mode, and the count of active exclusions.
Time to triage: median minutes from a rundll32 alert to a decision on whether credentials were exposed.

Common failure patterns

Allowlisting the binary: excluding rundll32.exe from EDR or SIEM rules because it is noisy removes visibility of the exact path attackers use.
Allowlisting by DLL name: an exclusion for "shell32.dll" or "zipfldr.dll" also excludes their abuse; include path, export and publisher.
No image load or network data: command line only rules miss ordinal calls, renamed DLLs and payloads that look benign in the arguments.
Name-only matching: rules on Image ending in rundll32.exe miss a renamed copy; add OriginalFileName.
Treating it as malware-only: closing a rundll32 alert after cleaning the DLL, without checking for LSASS access, leaves stolen credentials in use.

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK v20	T1218.011 Rundll32; detection strategy DET0475; mitigation M1050 Exploit Protection	Technique definition, analytic AN1308 and its log sources
MITRE ATT&CK v20	T1218.002 Control Panel, T1036.003 Rename Legitimate Utilities, T1003.001 LSASS Memory, T1129 Shared Modules	Adjacent techniques that appear in the same chains
NIST CSF 2.0	PR.PS-05, DE.CM-09, DE.AE-02	Preventing unauthorised software execution; monitoring endpoints; analysing adverse events
NIST SP 800-53 Rev. 5	CM-7(5), SI-4, SI-4(12), AU-12, AC-6	Allow-by-exception software, system monitoring, automated alerts, audit generation, least privilege
ISO/IEC 27001:2022 Annex A	A.8.15 Logging, A.8.16 Monitoring activities, A.8.19 Installation of software on operational systems	Logging, monitoring and software control obligations

Practitioner checklist

Confirm process creation with command line, rundll32-scoped image loads, network and DNS telemetry from at least 95 percent of Windows endpoints.
Build and own a baseline lookup of DLL path, export, parent and publisher for rundll32.
Match on OriginalFileName as well as image path in every rule.
Alert at high severity on script protocol arguments, LSASS access with comsvcs.dll in the call trace and download-then-load sequences.
Run user-path, non-DLL extension, unsigned module and outbound network patterns as tuned alerts.
Deploy the Office child process, prevalence, LSASS and copied system tools ASR rules, audit first.
Restrict rundll32 egress on user devices and disable WebClient where it is not needed.
Write the triage steps above into the SOC runbook, including the credential reset decision.
Test T1218.011 detections at least quarterly and track precision per pattern.

MITRE ATT&CK T1218.011 System Binary Proxy Execution: Rundll32 Detection Queries and Response