Obfuscated PowerShell Execution via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•19

Detects obfuscated PowerShell execution initiated via rundll32.exe. This rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName contains specific keywords indicative of rundll32.exe being used to execute obfuscated commands, potentially involving PowerShell.