Shdocvw.dll — LOLBAS

Execute

Execution Windows

Launch an executable payload via proxy through a URL (information) file by calling OpenURL.

Use Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.

rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}

Context: user
Native: Execute
MITRE: T1218.011
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
Refs: www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/
bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/
twitter.com/bohops/status/997690405092290561
windows10dll.nirsoft.net/shdocvw_dll.html
lolbas-project.github.io/lolbas/Libraries/Shdocvw/