Invoke-Obfuscation via MSHTA in PowerShell Scripts

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•16

Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.