Invoke-Obfuscation STDIN+ Launcher

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the execution of PowerShell commands via `cmd.exe` where the PowerShell script is passed through standard input (STDIN) and includes obfuscation techniques. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to pipe output to `powershell.exe`, and the PowerShell command itself contains either `${input}` or `noexit` along with `Invoke-Expression` and `DownloadString` patterns, indicative of obfuscated remote code execution.