Obfuscated PowerShell Execution via Rundll32 Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects the creation of a new service where the ImagePath contains 'rundll32' and 'shell32.dll' along with obfuscation indicators like '&&', 'value', 'invoke', 'comspec', or 'iex'. This pattern is often used by adversaries to execute obfuscated PowerShell commands via rundll32, specifically leveraging 'shellexec_rundll'.