.. /Shell32.dll
Star

Windows Shell Common Dll

Paths:

c:\windows\system32\shell32.dll
c:\windows\syswow64\shell32.dll

Resources:

Acknowledgements:

Adam (Control_RunDLL) (@hexacorn)
Pierre-Alexandre Braeken (ShellExec_RunDLL) (@pabraeken)
Matt Graeber (ShellExec_RunDLL) (@mattifestation)
Kyle Hanslovan (ShellExec_RunDLL) (@KyleHanslovan)

Detections:

Execute

Launch a DLL payload by calling the Control_RunDLL function.
```
rundll32.exe shell32.dll,Control_RunDLL c:\path\to\payload.dll
```
Use case
Load a DLL payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011
Tags
Execute: DLL
This LOLBAS executes Dynamic-Link Libraries (DLLs).
Launch an executable by calling the ShellExec_RunDLL function.
```
rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe
```
Use case
Run an executable payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011
Launch command line by calling the ShellExec_RunDLL function.
```
rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi"
```
Use case
Run an executable payload.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218.011