Invoke-Obfuscation VAR+ Launcher Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.