PowerShell Module: Obfuscated Invoke Using rundll32 and shell32.dll

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

FreeUnreviewedSigmahighv1

powershell-module-obfuscated-invoke-using-rundll32-and-shell32-dll-88a22f69

title: "PowerShell Module: Obfuscated Invoke Using rundll32 and shell32.dll"
id: ce46b2c9-0cbf-4c37-8c7b-fdefb3125bfd
related:
  - id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b
    type: derived
  - id: 88a22f69-62f9-4b8a-aa00-6b0212f2f05a
    type: derived
status: test
description: This rule identifies PowerShell module activity where the payload contains obfuscation-like patterns combined with rundll32 execution of shell32.dll and the shellexec_rundll export. It also matches when the payload includes values consistent with process invocation and common scripting execution patterns (e.g., invoke, comspec, iex). Attackers may use this approach to conceal command execution flow while leveraging built-in Windows components. The detection relies on PowerShell module telemetry with a captured payload field that includes specific string fragments.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2019-10-08
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|contains|all:
      - "&&"
      - rundll32
      - shell32.dll
      - shellexec_rundll
    Payload|contains:
      - value
      - invoke
      - comspec
      - iex
  condition: selection_4103
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell module activity where the payload contains obfuscation-like patterns combined with rundll32 execution of shell32.dll and the shellexec_rundll export. It also matches when the payload includes values consistent with process invocation and common scripting execution patterns (e.g., invoke, comspec, iex). Attackers may use this approach to conceal command execution flow while leveraging built-in Windows components. The detection relies on PowerShell module telemetry with a captured payload field that includes specific string fragments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.