Rundll32.exe /sta CLSID Invocation Hiding DLL Path (IShellRunDll)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•6

Detects the execution of rundll32.exe with the '/sta' command-line flag and a GUID-formatted CLSID. This technique is often used by malware (e.g., DarkME RAT) to proxy execution through COM components, which hides the actual path of the loaded DLL or payload, aiding in evasion.