Loading story…
Security researchers documented and detection engineers tracked a Windows application control bypass technique in which rundll32.exe invokes the LaunchINFSection function in advpack.dll, ieadvpack.dll, or syssetup.dll to execute script content from INF files. The behavior is associated with LOLBAS tradecraft and can be abused to bypass allowlisting controls, enabling arbitrary code execution and creating opportunities for privilege escalation, persistence, and wider host compromise.
Splunk published analytics to identify this activity using EDR and Windows process telemetry, including command-line logging, Sysmon Event ID 1, Windows Security Event ID 4688, and CrowdStrike ProcessRollup2 data mapped to the Endpoint data model. Those detections, aligned to MITRE ATT&CK T1218.011 for Rundll32, were later deprecated and replaced by a broader rule named "Windows Application Whitelisting Bypass Attempt via Rundll32," while the underlying technique remained notable because legitimate use of these DLL invocation patterns is considered uncommon and potentially high-signal for malicious execution.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detections "Detect Rundll32 Application Control Bypass - advpack" and "Detect Rundll32 Application Control Bypass - syssetup" from its content library after deprecating them. Both were replaced by a newer detection named "Windows Application Whitelisting Bypass Attempt via Rundll32."
The LOLBAS Project published an entry for Advpack, documenting it as a living-off-the-land binary/script/library technique reference.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourcelolbas-project.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors across espionage, cybercrime, and ransomware operations have repeatedly abused the native Windows binary **`rundll32.exe`** to execute malicious DLLs, stage payloads, evade defenses, and maintain persistence. MITRE ATT&CK catalogs the technique as **`T1218.011`** under *System Binary Proxy Execution*, citing use by groups and malware including **APT28**, **APT29**, **Sandworm**, **QakBot**, **IcedID**, **Bumblebee**, **Bad Rabbit**, **NotPetya**, **Egregor**, **MegaCortex**, and **Ragnar Locker**. The LOLBAS project likewise identifies `rundll32.exe` as a legitimate signed binary that can be repurposed to proxy malicious execution on Windows systems. One documented abuse path uses **`setupapi.dll`** or **`iesetupapi.dll`** with the **`LaunchINFSection`** function to bypass application control and trigger arbitrary script or payload execution, a method also described in public research on INF/SCT fetch-and-execute tradecraft for evasion and persistence. Splunk previously published a detection for suspicious `rundll32.exe` command lines tied to this behavior before replacing it with a broader analytic for Windows application whitelisting bypass attempts, underscoring continued defender focus on `rundll32.exe` as a high-risk living-off-the-land execution vector.
Aug 15, 2026
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
Palo Alto Networks Unit 42 reported that hunting for **unsigned DLLs** can uncover both commodity malware and advanced persistent threat activity that may evade behavior-based detections. The research found attackers commonly place malicious DLLs in unprivileged locations such as `ProgramData`, `AppData`, and user profile directories, then execute them through trusted Windows binaries including `rundll32.exe` and `regsvr32.exe`, or by abusing legitimate applications through DLL side-loading and search-order hijacking. Analysts said high-entropy files, scrambled names, rare execution patterns, and DLLs loaded from unusual paths are strong indicators for early detection. The report tied this technique to multiple threat clusters. **Stately Taurus** (Mustang Panda/PKPLUG) was observed using DLL search-order hijacking with `AvastSvc.exe` to load PlugX, while **Selective Pisces** (Lazarus Group) used `MagicLine4NX.exe`, `wsmprovhost.exe`, `mi.dll`, and a malicious `ualapi.dll` to maintain persistence. Unit 42 also linked frequent `rundll32.exe` and `regsvr32.exe` execution of DLLs from random `ProgramData` or `AppData` folders to **Raspberry Robin**, which typically starts from a malicious USB shortcut and later retrieves payloads through `msiexec.exe`.
Jun 29, 2026