Invoke-Obfuscation PowerShell via Rundll32 Launcher

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the execution of PowerShell scripts obfuscated using techniques associated with Invoke-Obfuscation, specifically when launched via rundll32.exe and shell32.dll. This method is often used by adversaries to evade detection and execute malicious PowerShell code.