PowerShell Obfuscation Using rundll32 and shell32.dll via Script Block Logging

title: PowerShell Obfuscation Using rundll32 and shell32.dll via Script Block Logging
id: e1c3d2a0-fbb7-4c0e-be21-90a4d30bb48a
status: test
description: This rule identifies PowerShell script block content that includes rundll32 execution patterns associated with shell32.dll and related rundll exports, combined with common obfuscation/evasion strings such as invoke/iex/comspec/value. Attackers may use this technique to hide or stage execution by leveraging rundll32-backed shell functionality within PowerShell. The detection relies on Script Block Logging telemetry that captures ScriptBlockText content for the specified substrings and conjunction.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2019-10-08
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|contains|all:
      - "&&"
      - rundll32
      - shell32.dll
      - shellexec_rundll
    ScriptBlockText|contains:
      - value
      - invoke
      - comspec
      - iex
  condition: selection_4104
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b
    type: derived