Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for unique string manipulation techniques used by Invoke-Obfuscation to construct PowerShell commands, often involving concatenation of environment variables or special PowerShell variables and their indices.