Invoke-Obfuscation STDIN+ Launcher via Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.