Obfuscated PowerShell Execution via Stdin

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.