Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Sigma rule (View on GitHub)
1title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
2id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
3status: test
4description: Detects Obfuscated Powershell via RUNDLL LAUNCHER
5references:
6 - https://github.com/SigmaHQ/sigma/issues/1009 # (Task 23)
7author: Timur Zinniatullin, oscd.community
8date: 2020/10/18
9modified: 2022/11/29
10tags:
11 - attack.defense_evasion
12 - attack.t1027
13 - attack.execution
14 - attack.t1059.001
15logsource:
16 product: windows
17 category: ps_script
18 definition: 'Requirements: Script Block Logging must be enabled'
19detection:
20 selection_4104:
21 ScriptBlockText|contains|all:
22 - 'rundll32.exe'
23 - 'shell32.dll'
24 - 'shellexec_rundll'
25 - 'powershell'
26 condition: selection_4104
27falsepositives:
28 - Unknown
29level: medium
References
Related rules
- ConvertTo-SecureString Cmdlet Usage Via CommandLine
- Invoke-Obfuscation CLIP+ Launcher - Security
- Invoke-Obfuscation COMPRESS OBFUSCATION
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module