Rundll32 LOLBin Suspicious Execution - T1218.011

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the execution of rundll32.exe with command-line arguments typically used for proxy execution of scripts or malicious DLL functions (javascript:, vbscript:, ShellExec_RunDLL, LaunchINFSection), which is a common technique used by attackers to bypass security controls and execute arbitrary code, excluding instances involving comsvcs.dll.