Obfuscated PowerShell Execution via Rundll32 Service Creation
This rule detects the creation of a new Windows service where the ImagePath contains 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell'. This specific combination is indicative of an attempt to execute obfuscated PowerShell code via rundll32.exe, a common technique for defense evasion and execution.
Sigma
