Rundll32 Loading Suspicious Non-DLL Extensions via Ordinal

F S@Fsdr

•updated Jun 26, 2026•1•0•4

Detects instances where rundll32.exe is used to execute a file with a suspicious non-DLL extension (such as .tmp, .dat, .bin, .jpg, etc.) by specifying an exported function via an ordinal number. Adversaries often use this technique to proxy malicious code execution while attempting to evade security tools that only look for standard .dll extensions.