T1218.011 Rundll32 in real malware

ATT&CK technique T1218.011 Rundll32 appears in 2 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is rising (1 recent vs 0 prior).

Tactics: stealth

Prevalence in the corpus

• Samples exhibiting T1218.011: 2
• Share of analyzed corpus: 0.0%
• Last 7 days: 1 · prior 7 days: 0 (rising)

Example samples

• a9af701a7a57022dcc0b2148a39c08fe45e9b030428652dc6250a8b6e5e00d53 - malicious
• libwinpthread-1.dll - malicious

Canonical technique definition: MITRE ATT&CK T1218.011 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1218.011

How common is ATT&CK T1218.011 (Rundll32) in real malware?

ATT&CK technique T1218.011 Rundll32 appears in 2 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is rising (1 recent vs 0 prior).

Is T1218.011 becoming more common?

Prevalence is rising: 1 sample in the last seven days against 0 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.

What share of analyzed samples use T1218.011?

0.0% of the publicly analyzed corpus (2 of 100981 samples) exhibits T1218.011. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats