Used by Windows to execute dll files
rundll32 "C:\ads\file.txt:ADSDLL.dll",DllMain
Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).
Execute code from alternate data stream
C:\Windows\System32\rundll32.exe, C:\Windows\SysWOW64\rundll32.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml, Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml, IOC: Outbount Internet/network connections made from rundll32, IOC: Suspicious use of cmdline flags such as -sta
Casey Smith (@subtee), Oddvar Moe (@oddvarmoe), Jimmy (@bohops), Sailay (@404death), Martin Ingesen (@Mrtn9)