diff --git a/yml/OSLibraries/Shell32.yml b/yml/OSLibraries/Shell32.yml index 69d05f2..a8731cb 100644 --- a/yml/OSLibraries/Shell32.yml +++ b/yml/OSLibraries/Shell32.yml @@ -31,6 +31,15 @@ Commands: OperatingSystem: Windows 10, Windows 11 Tags: - Execute: CMD + - Command: rundll32.exe shell32.dll,#44 {PATH:.dll} + Description: Load a DLL/CPL by calling undocumented Control_RunDLLNoFallback function. + Usecase: Load a DLL/CPL payload. + Category: Execute + Privileges: User + MitreID: T1218.011 + OperatingSystem: Windows 10, Windows 11 + Tags: + - Execute: DLL Full_Path: - Path: c:\windows\system32\shell32.dll - Path: c:\windows\syswow64\shell32.dll @@ -43,8 +52,9 @@ Resources: - Link: https://twitter.com/mattifestation/status/776574940128485376 - Link: https://twitter.com/KyleHanslovan/status/905189665120149506 - Link: https://windows10dll.nirsoft.net/shell32_dll.html + - Link: https://www.hexacorn.com/blog/2025/05/18/shell32-dll-44-lolbin/ Acknowledgement: - - Person: Adam (Control_RunDLL) + - Person: Adam (Control_RunDLL, Control_RunDLLNoFallback) Handle: '@hexacorn' - Person: Pierre-Alexandre Braeken (ShellExec_RunDLL) Handle: '@pabraeken'