Abuse of the legitimate rundll32.exe system binary to proxy the execution of malicious DLLs, Control Panel Items (.cpl), or scripts (e.g., JavaScript) to evade security controls and blend in with normal system activity.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
IEX · Execute a Local Script Path
Execute a Local Script Path
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: not documented.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER