Invoke-Obfuscation STDIN+ Launcher - PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.