Invoke-Obfuscation Obfuscated IEX Invocation via Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects various obfuscated PowerShell IEX invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for regex patterns in the ImagePath field of Event ID 7045 (Service Creation) that are characteristic of Invoke-Obfuscation's techniques to hide PowerShell commands.