Rundll32 Executing HTML Application or JavaScript

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•1

Detects the execution of rundll32.exe with command-line arguments indicative of running an HTML Application (mshtml,RunHTMLApplication) or directly executing JavaScript. This technique is often used by adversaries for code execution and bypassing security controls.