Ground your SOC agent on what Windows processes actually do.

{
  "name": "rundll32.exe",
  "known": true,
  "category": "Operating System",
  "publisher": "Microsoft",
  "description": "RunDLL32 (rundll32.exe) executes DLL files by calling a specified export function.",
  "most_common_parent": {
    "name": "svchost.exe",
    "share_pct": 46.44,
    "verdict": "normal"
  },
  "full_record_available": true,
  "upgrade_url": "https://echotrail.io/pricing/"
}

The current rundll32.exe record. Lists are cut to the top three and empty fields are hidden for display; the API returns them.

{
  "process_name": "rundll32.exe",
  "description": "RunDLL32 (rundll32.exe) executes DLL files by calling a specified export function. It allows Windows and applications to run code stored in DLLs without a standalone executable. It is one of the most commonly abused LOLBins due to its ability to execute arbitrary code from DLLs.",
  "intel": {
    "normal_behavior": "Located in C:\\Windows\\System32 or C:\\Windows\\SysWOW64. Common parents include svchost.exe, explorer.exe, and spoolsv.exe. Can spawn itself recursively. Used legitimately for control panel applets, shell extensions, and DLL registration.",
    "suspicious_indicators": "Running from a non-standard path. Command-line pointing to DLLs in temp directories, user profiles, or download folders. Executing DLLs via URL (rundll32.exe javascript:\"..\"). Spawning shells (cmd.exe, powershell.exe). Making outbound network connections. Command-line referencing unusual export function names. Being launched by Office applications or script interpreters.",
    "abuse_patterns": "Proxy execution: attackers use rundll32 to execute malicious DLLs, bypassing application whitelisting since rundll32 is a signed Microsoft binary. JavaScript execution: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication\" can execute arbitrary JavaScript. DLL sideloading: placing a malicious DLL where rundll32 will find it. Payload delivery: malware droppers often use rundll32 to execute their DLL payloads. Cobalt Strike and other C2 frameworks frequently use rundll32 for DLL injection and execution.",
    "detection_guidance": "High-confidence: rundll32.exe executing DLLs from temp/user profile directories. rundll32.exe with javascript: in the command-line. rundll32.exe making outbound network connections. rundll32.exe spawned by Office applications. Medium-confidence: rundll32.exe with unusual export function names. rundll32.exe loading DLLs not in System32 or known application directories. Monitor Sysmon Event ID 1 (command-line) and Event ID 7 (DLL loads).",
    "false_positive_notes": "Very common in legitimate Windows operations. Shell extensions, control panel applets, and printer drivers use rundll32. explorer.exe launching rundll32 is normal for shell operations. svchost.exe spawning rundll32 for system maintenance is expected. Focus on the DLL path and export function in the command-line rather than rundll32 execution alone.",
    "mitre_techniques": [
      "T1218.011",
      "T1055.001",
      "T1036.005"
    ]
  },
  "classification": {
    "category": "Operating System",
    "publisher": "Microsoft",
    "is_lolbin": true,
    "risk_level": "high",
    "related_processes": [
      "cmd.exe",
      "powershell.exe",
      "explorer.exe"
    ]
  },
  "executions": {
    "total": 688986
  },
  "parents": {
    "total": 688918,
    "top": [
      {
        "name": "svchost.exe",
        "count": 319953,
        "percentage": 46.4428
      },
      {
        "name": "explorer.exe",
        "count": 138407,
        "percentage": 20.0905
      },
      {
        "name": "rundll32.exe",
        "count": 131240,
        "percentage": 19.0502
      }
    ]
  },
  "children": {
    "top": [
      {
        "name": "rundll32.exe",
        "count": 131240
      },
      {
        "name": "WinSAT.exe",
        "count": 2494
      },
      {
        "name": "winsat.exe",
        "count": 1866
      }
    ]
  },
  "grandparents": {
    "top": [
      {
        "name": "services.exe",
        "count": 188138
      },
      {
        "name": "explorer.exe",
        "count": 121434
      },
      {
        "name": "userinit.exe",
        "count": 61625
      }
    ]
  },
  "paths": {
    "total": 688986,
    "top": [
      {
        "path": "C:\\Windows\\System32",
        "count": 673066,
        "percentage": 97.6894
      },
      {
        "path": "C:\\Windows\\SysWOW64",
        "count": 15494,
        "percentage": 2.2488
      },
      {
        "path": "C:\\WINDOWS\\System32",
        "count": 226,
        "percentage": 0.0328
      }
    ]
  }
}