Rundll32 DLL Execution from Suspicious Dirs or Script Handlers

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects execution of rundll32.exe from suspicious directories, such as user profiles, temporary folders, or ProgramData, or the usage of script protocol handlers like javascript: or vbscript:. This pattern is commonly used by adversaries to proxy execution of malicious code, bypass security controls, and execute scripts via a signed system binary.