Invoke-Obfuscation Obfuscated IEX Invocation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. It specifically looks for command-line arguments that use variable manipulation (e.g., $PSHome, $ShellId, $env:Public, $env:ComSpec) and string concatenation to construct and execute PowerShell commands, which is a common technique for defense evasion.