Invoke-Obfuscation VAR++ LAUNCHER PowerShell Obfuscation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects the use of Invoke-Obfuscation's VAR++ LAUNCHER technique, which obfuscates PowerShell commands using variable manipulation and string formatting. This technique is identified by specific patterns in the ServiceFileName field of Windows Security Event ID 4697, indicating a service creation with obfuscated command-line arguments.