Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.