Invoke-Obfuscation CLIP+ Launcher - System
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Sigma
