rundll32 test

rundll32.exe javascript:\..\mshtml,RunHTMLApplication

Executes code with rundll32 on the test host, validating detection of the abuse of the legitimate binary to run JavaScript.

Run it in the purple team lab when you want to validate detection of rundll32 execution: the command uses the legitimate binary with the mshtml trick to run JavaScript and the team checks what was detected — Sysmon Event 1 (rundll32 with the arguments), SIEM rules, EDR. It's the validation of living off the land in execution: the legitimate binary used to run arbitrary code. In purple teaming, rundll32 validates the behavioral layer of execution by the system binary.

Do not run it outside the lab: the JavaScript execution generates real activity — the test host is the place. And note: rundll32 is legitimate (loads system DLLs) — detection relies on anomalous arguments (javascript:, mshtml) and context; validation measures those layers. Legitimate uses of rundll32 (system DLLs) generate noise: the validated rule is the one for abuse arguments. Clean up when done.