Suspicious DLL Invocation Using Rundll32 Triggered by Node.js Runtime
Rundll32.exe is a built-in Windows utility that enables execution of DLL files by invoking specific functions exported from them. While it is used legitimately across various system operations, attackers frequently exploit it to execute malicious code because it is a trusted binary and less likely to trigger security alerts. This technique is recognized in the MITRE ATT and CK framework under the identifier T1218.011 as a method for defense evasion. In typical usage scenarios, Node.js operates as a JavaScript runtime for developing applications and executing server-side scripts. It does not ordinarily engage with DLL files or initiate their execution through rundll32.exe.. When Node.js is observed invoking rundll32 to launch a DLL, this represents highly unusual behavior and may signal a compromise or malware deployment. Such activity warrants investigation, especially when linked to suspicious network callbacks or unverified software packages distributed through npm.
Microsoft Sentinel (KQL)
