# Is rundll32.exe Executed Without Expected Dll Path?

**URL:** <https://community.limacharlie.com/t/is-rundll32-exe-executed-without-expected-dll-path/55>\
**Category:** LCQL Queries\
**Tags:** lcql\
**Created:** [February 17, 2025, 9:19pm UTC](https://community.limacharlie.com/t/is-rundll32-exe-executed-without-expected-dll-path/55 "2025-02-17T21:19:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric\_capuano](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/eric_capuano/32/4_2.png) [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\
**Post date:** [February 17, 2025, 9:19pm UTC](https://community.limacharlie.com/t/is-rundll32-exe-executed-without-expected-dll-path/55/1 "2025-02-17T21:19:37Z")

</div>

**Description of the query:**  
Look for executions of rundll32.exe with its expected CLI args (a path to a DLL)

**Query:**

```auto
-6h | plat==windows | NEW_PROCESS EXISTING_PROCESS | event/FILE_PATH contains "rundll32.exe" AND event/COMMAND_LINE not contains ".dll" | ts as Timestamp event/FILE_PATH as Path event/COMMAND_LINE as CommandLine

```