PowerShell Token Obfuscation Detection
Detects token obfuscation techniques commonly used by Invoke-Obfuscation within PowerShell scripts. This rule is designed to identify highly obfuscated PowerShell code that attempts to evade detection by manipulating string formatting, environment variables, and character escaping. It can be used as a threat-hunting baseline to find suspicious scripts in an environment.
Sigma
