Invoke-Obfuscation Obfuscated IEX Invocation
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for distinct string manipulation and variable concatenation techniques used by the framework within the ServiceFileName field of Windows Security Event ID 4697.
Sigma
