Invoke-Obfuscation COMPRESS OBFUSCATION Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.