Invoke-Obfuscation Via Use Clip - System Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.