Suspicious PowerShell Invocations - PowerShell Module

SigmaHQ Detections@sigmaHQ

•updated May 12, 2025•2•0•20

Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious activity, including base64 encoded commands, use of `IEX` (Invoke-Expression) with `New-Object`, encoded commands, attempts to establish persistence via Registry Run keys, and web client downloads.