Invoke-Obfuscation STDIN+ Launcher via Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects obfuscated use of stdin to execute PowerShell commands, specifically looking for the creation of a service with a command line containing 'cmd', 'powershell', input redirection ('${input}'), 'noexit', and command execution flags (' /c ', ' /r '). This pattern is indicative of techniques used by tools like Invoke-Obfuscation to hide malicious PowerShell execution.