T1218.011: Rundll32 Executing DLL from Browser Cache Directory (Cache Smuggling)

Tim Peck@timpeck

•updated today•4•0•43

Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.