Obfuscated PowerShell Service Creation via Clipboard Utility

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.