Invoke-Obfuscation COMPRESS OBFUSCATION via Service Creation
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
Sigma
