Rundll32 proxies JavaScript through mshtml's HTML application runner

Siemphony@siemphonyhighT1218.011verified in labPlaybook · Unexpected execution

AN1308 lists rundll32.exe invoked with a javascript: argument and RunHTMLApplication among its suspicious-invocation indicators. The rule requires both terms together, matching the published LOLBAS chain rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";... — a syntax with no ordinary Windows or application workflow behind it, unlike a bare rundll32.exe DLL,Function invocation which is far too common to use alone. This is one analytic among a family of rundll32 subtechniques already in this corpus (Regsvcs/Regasm, Verclsid, Mavinject, MMC, Electron, Compiled HTML); none of them share this mshtml script-proxy mechanism. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0475, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Rundll32 proxies JavaScript through mshtml's HTML application runner2id: e25f958c-4fb5-434f-9302-b01f0a9f89fa3status: experimental4description: |5  AN1308 lists rundll32.exe invoked with a javascript: argument and6  RunHTMLApplication among its suspicious-invocation indicators. The rule7  requires both terms together, matching the published LOLBAS chain8  rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";... — a syntax with9  no ordinary Windows or application workflow behind it, unlike a bare10  rundll32.exe DLL,Function invocation which is far too common to use alone.11  This is one analytic among a family of rundll32 subtechniques already in12  this corpus (Regsvcs/Regasm, Verclsid, Mavinject, MMC, Electron, Compiled13  HTML); none of them share this mshtml script-proxy mechanism.14  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0475, not hand-written and not tested by its author. Any lab result is on this rule's own page.15references:16  - https://attack.mitre.org/techniques/T1218/01117  - https://attack.mitre.org/detectionstrategies/DET047518author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)19date: 2026-08-1620tags:21  - attack.defense-evasion22  - attack.t1218.01123logsource:24  category: process_creation25  product: windows26detection:27  selection_img:28    Image|endswith: '\rundll32.exe'29  selection_js:30    CommandLine|contains: 'javascript:'31  selection_html:32    CommandLine|contains: 'RunHTMLApplication'33  condition: selection_img and selection_js and selection_html34falsepositives:35  - "Atomic Red Team, Caldera or similar purple-team frameworks replaying the published T1218.011 test case verbatim, which uses this exact command line."36  - "Security-awareness or detection-engineering training labs that reproduce the public LOLBAS proof-of-concept command as a teaching example."37level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\rundll32.exe" and ProcessCommandLine contains "javascript:") and ProcessCommandLine contains "RunHTMLApplication")

Splunk · SPL

Run this as a search.

index=* ((Image="*\\rundll32.exe" AND CommandLine="*javascript:*") AND CommandLine="*RunHTMLApplication*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" AND TO_LOWER(process.command_line) LIKE "*javascript:*") AND TO_LOWER(process.command_line) LIKE "*runhtmlapplication*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\rundll32\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)javascript:</field>    <field name="CommandLine" type="pcre2">(?i)RunHTMLApplication</field>    <description>Rundll32 proxies JavaScript through mshtml's HTML application runner</description>    <mitre>      <id>T1218.011</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e25f958c-4fb5-434f-9302-b01f0a9f89fa

ATT&CKT1218.011

T1218.011Rundll32

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — Rundll32 proxy execution
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.011, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The reviewer's catch is the important one here: Image|endswith: '\rundll32.exe' only matches when the running file is literally named rundll32.exe. Copy or rename that binary and the identical javascript:/RunHTMLApplication command line sails past this selector untouched. The review points out that Sysmon EID 1's OriginalFileName field — present on the same logsource, unused here — reads the binary's compiled-in internal name and would survive that rename; adding OriginalFileName|endswith: 'RUNDLL32.EXE' as an additional OR clause is the reviewer's suggested fix, at low cost to the rule's existing precision.
Separately, the brief's mutableElements name four knobs for AN1308 as a whole: TimeWindow (correlating invocation with a later DLL load or network callout), ParentProcessFilter (scoping to suspicious parents like explorer.exe or Office apps versus trusted installers), AllowedDLLs (a baseline of legitimate DLLs), and ExternalIPRange (scoping anomalous destinations). This rule implements none of them — it is a static, single-event match, not a correlation. MITRE names those knobs; it does not supply values for them. If an analyst adds a ParentProcessFilter, the specific process names populating it are that analyst's own judgment about their environment, not something sourced from MITRE.

Declared by the author

Atomic Red Team, Caldera or similar purple-team frameworks replaying the published T1218.011 test case verbatim, which uses this exact command line.
Security-awareness or detection-engineering training labs that reproduce the public LOLBAS proof-of-concept command as a teaching example.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

This rule catches one narrow rundll32.exe invocation pattern: the mshtml script-proxy syntax, rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";.... That is AN1308's javascript: / RunHTMLApplication indicator specifically — not the whole rundll32-abuse surface AN1308 describes, which also covers .dll and .cpl argument patterns, suspicious module loads, and external network callouts. The rule's own description is explicit that this is one analytic among several sibling rundll32 subtechnique rules already in this corpus (Regsvcs/Regasm, Verclsid, Mavinject, MMC, Electron, Compiled HTML), and that none of them share this particular mechanism.

02 · Telemetry you need

All three selections read Sysmon EventID 1 (process_creation/windows), pulling Image and CommandLine — the logsource is copied verbatim from the brief. Sysmon is not installed by default on Windows, so before this rule can fire anywhere, Sysmon needs to be deployed with a config that captures command-line arguments (the standard SwiftOnSecurity/Olaf configs do this). The brief also lists four other log sources for AN1308 — module load (EID 7), file creation (EID 11), network connection (EID 3), and DNS query (EID 22) — none of which this rule reads at all.

03 · How the logic works

Three selections, ANDed: selection_img (Image|endswith: '\rundll32.exe'), selection_js (CommandLine|contains: 'javascript:'), and selection_html (CommandLine|contains: 'RunHTMLApplication'), with condition: selection_img and selection_js and selection_html. Requiring all three on the same command line is deliberate: javascript: alone would be far too broad, and a bare rundll32.exe DLL,Function invocation is normal Windows behavior, but the full published syntax together has no ordinary workflow behind it. AN1308 actually describes a multi-stage chain — invocation, then a follow-on DLL load or external network callout, correlated within a time window — but lib/sigma in this corpus has no aggregation, near, or timeframe support. So this rule can only be a single-event precursor for the first stage of that chain; it cannot express the correlation MITRE describes. That's the norm for this corpus, not a defect specific to this rule.

04 · Common false positives

Both falsepositives entries describe someone deliberately running the exact published test case: Atomic Red Team/Caldera purple-team replays, and security-awareness or detection-engineering training labs reproducing the public PoC verbatim. That's a narrow, low-volume source, not a high-volume one — and the review agent flagged this as one of the few rules in the batch where the loudest listed false positive genuinely supports level: high rather than contradicting it.

05 · Detection maturity

tier_1: UNVERIFIED — the lowest tier. This rule has never been run against real telemetry, in test or production. validation.json confirms it parses and renders in all four target backends (Sentinel KQL, Splunk SPL, Elastic ES|QL, Wazuh XML) without refusal, but that only proves it translates cleanly — it says nothing about hit rate, false-positive volume, or whether it catches a real attack. No such numbers exist yet, and none are asserted here. Moving it past this tier means running it against actual Sysmon EID 1 data, starting with the Atomic Red Team replay of the exact T1218.011 test case the falsepositives entry already names.

Related detections3 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/e25f958c-4fb5-434f-9302-b01f0a9f89fa

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@priya-raman
2 Sept 2026
Ran the published LOLBAS chain through the lab and this matched first try, which makes it my favourite kind of rule: a range-validation canary. The public atomic for T1218.011 replays that exact command line, so if this does NOT fire during a purple-team exercise, something upstream of the rule is broken and you just found out for free. Requiring javascript: and RunHTMLApplication together is what keeps it deployable — a bare rundll32 rule is a firehose, and this one has produced zero organic matches for us in three weeks because no legitimate workflow has that syntax.
- @hana-kobayashi
  2 Sept 2026
  Same baseline across every tenant: zero. Which is its own small trap — a rule that never fires falls out of everyone's working memory, and its first real hit lands on an analyst who has never triaged one. We keep a quarterly fire-drill list of exactly these known-zero, high-severity rules and replay the atomic against each; it is a ten-minute job per rule and it converts "we deployed it once" into "it still works".

Rundll32 proxies JavaScript through mshtml's HTML application runner

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread