Invoke-Obfuscation VAR+ Launcher - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects the use of Invoke-Obfuscation's VAR+ Launcher technique, which leverages obfuscated environment variables to execute PowerShell commands. This technique aims to evade detection by making the command-line arguments difficult to analyze.