Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects obfuscated PowerShell execution that leverages `clip.exe` to interact with the clipboard. The rule specifically looks for PowerShell module logs (Event ID 4103) where the payload contains `cmd` followed by `/c` or `/r`, then `clip` (with or without `.exe`), and finally a PowerShell command that accesses the clipboard using `[System.Windows.Forms.Clipboard]::SetText` or similar, often with string formatting. This technique is associated with `Invoke-Obfuscation`, a tool used to evade detection.