Invoke-Obfuscation VAR+ Launcher - PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects obfuscated PowerShell execution using environment variables, specifically looking for patterns indicative of Invoke-Obfuscation's VAR+ launcher. This technique involves setting environment variables with parts of a command and then reconstructing and executing it, often to evade detection.