Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects obfuscated use of stdin to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule specifically looks for patterns in PowerShell module logs (Event ID 4103) where 'cmd' is used with '/c' or '/r' to launch PowerShell, incorporating input from stdin (e.g., using ${input} or noexit).