Obfuscated PowerShell Execution via Rundll32
Detects obfuscated PowerShell execution attempts that leverage rundll32.exe and shell32.dll. The rule looks for specific keywords in the PowerShell module payload, such as '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll', combined with common PowerShell execution terms like 'value', 'invoke', 'comspec', or 'iex'. This combination suggests an attempt to bypass detection by using rundll32.exe to launch obfuscated PowerShell commands.
Sigma
