huntrule

Obfuscated PowerShell Execution via rundll32 Launcher (Windows PowerShell Script)

Identifies PowerShell script content invoking rundll32.exe/shell32.dll via shellexec_rundll and referencing PowerShell.

FreeUnreviewedSigmamediumv1
title: Obfuscated PowerShell Execution via rundll32 Launcher (Windows PowerShell Script)
id: ead596d8-87e9-403d-8542-f50b1681cb40
status: test
description: This rule flags PowerShell script block content that includes rundll32.exe along with shell32.dll and the shellexec_rundll launcher string, as well as the word powershell. Attackers may use rundll32-based launching to execute PowerShell while reducing direct visibility of the command line. The detection relies on Script Block Logging telemetry capturing ScriptBlockText content and matching these specific substrings.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|contains|all:
      - rundll32.exe
      - shell32.dll
      - shellexec_rundll
      - powershell
  condition: selection_4104
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
    type: derived

What it detects

This rule flags PowerShell script block content that includes rundll32.exe along with shell32.dll and the shellexec_rundll launcher string, as well as the word powershell. Attackers may use rundll32-based launching to execute PowerShell while reducing direct visibility of the command line. The detection relies on Script Block Logging telemetry capturing ScriptBlockText content and matching these specific substrings.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.