Potential PowerShell Obfuscation Using Character Join for Alias Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

This rule detects potential PowerShell obfuscation techniques where the '-join' operator is used within the '-Value' parameter of 'Set-Alias' or 'New-Alias' cmdlets. This method is often employed by adversaries to hide the true command or object being aliased, making it harder to analyze the script's intent. The rule specifically looks for the combination of '-Alias' and ' -Value (-join(' within PowerShell script block text.