Invoke-Obfuscation Via Stdin in PowerShell Module Logs

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects obfuscated PowerShell code being executed via standard input (stdin) within PowerShell module logs. This technique is often used by adversaries to evade detection by security products that monitor for suspicious commands or scripts.