Invoke-Obfuscation Via Clip.exe in PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects obfuscated PowerShell commands that utilize 'clip.exe' to interact with the clipboard, often as part of an obfuscation technique like those used by Invoke-Obfuscation. The rule specifically looks for patterns where 'echo' is piped to 'clip' and then followed by terms related to 'Clipboard' or 'invoke' with potential character obfuscation.