Invoke-Obfuscation VAR++ LAUNCHER in Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects obfuscated PowerShell commands used in service creation events, specifically looking for patterns indicative of Invoke-Obfuscation's VAR++ LAUNCHER technique. The rule identifies service creations where the ImagePath contains specific keywords like '&&set', 'cmd', '/c', '-f', and format specifiers like '{0}', '{1}', etc., which are characteristic of highly obfuscated PowerShell commands often used for defense evasion.