Invoke-Obfuscation via MSHTA and PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects obfuscated PowerShell execution leveraging MSHTA. This technique is often used for defense evasion by adversaries to execute malicious scripts without directly invoking PowerShell. The rule specifically looks for a combination of keywords indicative of this method, including 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' within the PowerShell module payload.