Invoke-Obfuscation RUNDLL LAUNCHER - Security Event 4697

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•19

Detects obfuscated PowerShell execution initiated via rundll32.exe, specifically looking for the combination of 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell' within the ServiceFileName field of Windows Security Event ID 4697 (Service Creation). This technique is often used for defense evasion and to execute malicious PowerShell scripts.