Matanbuchus - DLL Sideloading via RunDll32 Export (T1218.011)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Identifies rundll32.exe executing a DLL with a randomized or anomalous export function, combined with evidence of a DLL file being created on the system. This behavior is indicative of Matanbuchus DLL sideloading.