Windows Shell Common Dll
rundll32.exe shell32.dll,Control_RunDLL c:\path\to\payload.dll
Launch a DLL payload by calling the Control_RunDLL function.
Load a DLL payload.
c:\windows\system32\shell32.dll, c:\windows\syswow64\shell32.dll
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml, Splunk: https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/rundll32_control_rundll_hunt.yml
Adam (Control_RunDLL) (@hexacorn), Pierre-Alexandre Braeken (ShellExec_RunDLL) (@pabraeken), Matt Graeber (ShellExec_RunDLL) (@mattifestation), Kyle Hanslovan (ShellExec_RunDLL) (@KyleHanslovan)