PowerShell Module Logging: RUNDLL32 Shell32 Obfuscation with PowerShell

Alerts when PowerShell module payloads reference a shell32/rundll32 launcher pattern that includes PowerShell.

FreeUnreviewedSigmamediumv1

powershell-module-logging-rundll32-shell32-obfuscation-with-powershell-a23791fe

title: "PowerShell Module Logging: RUNDLL32 Shell32 Obfuscation with PowerShell"
id: 1f74940e-5644-4756-a8b3-26cce8bb9c8b
related:
  - id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
    type: derived
  - id: a23791fe-8846-485a-b16b-ca691e1b03d4
    type: derived
status: test
description: This rule flags PowerShell module activity where the script payload contains a RUNDLL32 launcher sequence using shell32.dll (including the shellexec_rundll identifier) and references powershell. Such launcher patterns can be used to obscure process intent and execute PowerShell via an indirect or less obvious invocation path. It relies on telemetry from Windows PowerShell module events, matching specific required strings within the recorded payload content.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|contains|all:
      - rundll32.exe
      - shell32.dll
      - shellexec_rundll
      - powershell
  condition: selection_4103
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell module activity where the script payload contains a RUNDLL32 launcher sequence using shell32.dll (including the shellexec_rundll identifier) and references powershell. Such launcher patterns can be used to obscure process intent and execute PowerShell via an indirect or less obvious invocation path. It relies on telemetry from Windows PowerShell module events, matching specific required strings within the recorded payload content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.