Invoke-Obfuscation RUNDLL LAUNCHER

 1title: Invoke-Obfuscation RUNDLL LAUNCHER
 2id: 03b024c6-aad1-4da5-9f60-e9e8c00fa64c
 3related:
 4    - id: 11b52f18-aaec-4d60-9143-5dd8cc4706b9
 5      type: derived
 6description: Detects Obfuscated Powershell via RUNDLL LAUNCHER
 7status: unsupported
 8author: Timur Zinniatullin, oscd.community
 9date: 2020/10/18
10modified: 2022/03/08
11references:
12    - https://github.com/SigmaHQ/sigma/issues/1009 #(Task 23)
13logsource:
14    product: windows
15    category: driver_load
16detection:
17    selection:
18        ImagePath|contains|all:
19            - 'rundll32.exe'
20            - 'shell32.dll'
21            - 'shellexec_rundll'
22            - 'powershell'
23    condition: selection
24falsepositives:
25    - Unknown
26level: medium
27tags:
28    - attack.defense_evasion
29    - attack.t1027
30    - attack.execution
31    - attack.t1059.001

References

• Invoke-Obfuscation · Issue #1009 · SigmaHQ/sigma

  

  Summary Tool: Invoke-Obfuscation — PowerShell command and script obfuscation framework Author: Daniel Bohannon, @danielhbohannon Type: Offensive tool, threat simulation Materials: The Invoke-Obfusc...

  
  Read More

Related rules

• Invoke-Obfuscation CLIP+ Launcher
• Invoke-Obfuscation COMPRESS OBFUSCATION
• Invoke-Obfuscation STDIN+ Launcher
• Invoke-Obfuscation VAR+ Launcher
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION