Rundll32 Execution Without Command Line Arguments

Tim Peck@timpeck

•updated Feb 23, 2026•6•0•43

Detects the execution of "rundll32.exe" without any command-line arguments. This is highly unusual behavior, as "rundll32.exe" is intended to load and run functions from DLLs, which requires specifying a DLL path in the command line. This technique is used by malware like ValleyRAT (as part of the Winos4.0 framework) to inject modular plugins into memory.