.. /Shell32.dll
Star

Execute (DLL, EXE, CMD)

Windows Shell Common Dll

Paths:

c:\windows\system32\shell32.dll
c:\windows\syswow64\shell32.dll

Resources:

Acknowledgements:

Adam (Control_RunDLL, Control_RunDLLNoFallback) (@hexacorn)
Pierre-Alexandre Braeken (ShellExec_RunDLL) (@pabraeken)
Matt Graeber (ShellExec_RunDLL) (@mattifestation)
Kyle Hanslovan (ShellExec_RunDLL) (@KyleHanslovan)

Detections:

Execute

Launch a DLL payload by calling the Control_RunDLL function.
```
rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}
```
Use case
Load a DLL payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011
Tags
Execute: DLL
Launch an executable by calling the ShellExec_RunDLL function.
```
rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}
```
Use case
Run an executable payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011
Tags
Execute: EXE
Launch command line by calling the ShellExec_RunDLL function.
```
rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}
```
Use case
Run an executable payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011
Tags
Execute: CMD
Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function.
```
rundll32.exe shell32.dll,#44 {PATH:.dll}
```
Use case
Load a DLL/CPL payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011
Tags
Execute: DLL