Windows Service Control Manager execution of rundll32 with obfuscated PowerShell indicators

title: Windows Service Control Manager execution of rundll32 with obfuscated PowerShell indicators
id: cb75bb34-93ed-4e46-9824-117b36f4025f
status: test
description: This rule flags Windows service creation events (EventID 7045) where the service ImagePath contains rundll32 usage alongside shell32.dll/shellexec_rundll elements and additional command-style tokens like value, invoke, comspec, and iex. Attackers can abuse service execution to run command chains and hide payload intent through obfuscation. The detection relies on System service-control telemetry, specifically Provider_Name "Service Control Manager" and the contents of the created service ImagePath field.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - "&&"
      - rundll32
      - shell32.dll
      - shellexec_rundll
    ImagePath|contains:
      - value
      - invoke
      - comspec
      - iex
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 641a4bfb-c017-44f7-800c-2aee0184ce9b
    type: derived