.. /Shell32.dll
Star

Execute (DLL)

Windows Shell Common Dll


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Launch a DLL payload by calling the Control_RunDLL function.

    rundll32.exe shell32.dll,Control_RunDLL c:\path\to\payload.dll
    Use case
    Load a DLL payload.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).

  2. Launch an executable by calling the ShellExec_RunDLL function.

    rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe
    Use case
    Run an executable payload.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011

  3. Launch command line by calling the ShellExec_RunDLL function.

    rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi"
    Use case
    Run an executable payload.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011