Obfuscated PowerShell Execution via Rundll32 and Shell32.dll

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.