Invoke-Obfuscation CLIP+ Launcher - Security Event 4697

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.