Invoke-Obfuscation VAR++ LAUNCHER - PowerShell Obfuscation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.