Windows System: Service Control Manager rundll32 Launching PowerShell via shell32

title: "Windows System: Service Control Manager rundll32 Launching PowerShell via shell32"
id: acf00256-05d3-424b-b433-707b1b78b0a0
status: test
description: This rule identifies Windows service creation (EventID 7045) where the service ImagePath contains rundll32.exe with shell32.dll, the shellexec_rundll export, and the string powershell. This behavior matters because attackers can use the rundll32/shell32 execution path to launch PowerShell while obscuring direct command invocation. The detection relies on System logs capturing Service Control Manager events and the ImagePath contents.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains|all:
      - rundll32.exe
      - shell32.dll
      - shellexec_rundll
      - powershell
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 11b52f18-aaec-4d60-9143-5dd8cc4706b9
    type: derived