Rundll32 FileProtocolHandler Command Execution Evasion add new sub-technique to T1218.011

[HyperionRising12]

technique utilizing rundll32.exe and the FileProtocolHandler method to execute a command without requiring administrative privileges. By leveraging rundll32.exe in this manner, the test aims to assess the effectiveness of antivirus solutions, including Bitdefender, Windows Defender, and others, in detecting and preventing command execution evasion. The provided command bypasses certain antivirus detections by using the FileProtocolHandler to execute the specified command, in this case, launching 'calc.exe'. This evasion technique is known for its ability to exploit legitimate processes to execute malicious commands while avoiding detection. The test serves as an evaluation of antivirus solutions' capabilities to detect and mitigate such evasion tactics, contributing to the overall assessment of endpoint security posture.

Details:
Rundll32 FileProtocolHandler Command Execution Evasion". The test demonstrates a technique using rundll32.exe and the FileProtocolHandler method to execute commands without requiring administrative privileges.This addition aims to assess the effectiveness of endpoint security solutions in detecting and mitigating command execution evasion techniques.

Testing:
rundll32.exe url.dll,FileProtocolHandler calc.exe

Associated Issues:
https://attack.mitre.org/techniques/T1218/011/

[clr2of8]

Thank you for your first-time contribution. Keep it up! Don't forget to claim your free Atomic Red Team t-shirt

[HyperionRising12]

Thank you ☀️☀️ wish all the best