Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects PowerShell scripts that utilize compression and decompression techniques, specifically looking for 'new-object', 'text.encoding]::ascii', 'system.io.compression.deflatestream', 'system.io.streamreader', and 'readtoend' in the payload. This pattern is indicative of obfuscated PowerShell often used by tools like Invoke-Obfuscation to hide malicious code.