PowerShell Bitwise XOR Operator Usage
Detects PowerShell execution that utilizes the bitwise XOR (bxor) operator. Attackers may use this as an alternative obfuscation method to Base64 encoded commands to evade detection. Investigation of the command line and process tree is recommended to determine if the activity is malicious.
Sigma
