Invoke-Obfuscation RUNDLL LAUNCHER via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.