Invoke-Obfuscation Via Stdin - Security Event 4697

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects obfuscated PowerShell commands being executed via standard input (stdin) by monitoring Windows Security Event ID 4697. The rule looks for specific keywords like 'set', '&&', 'environment', 'invoke', and '${input)' within the ServiceFileName field, which can indicate attempts to bypass detection by passing obfuscated scripts or commands directly to PowerShell.