Invoke-Obfuscation Via Stdin

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects obfuscated PowerShell execution via standard input (stdin) in scripts. This technique is often used by adversaries to evade detection by security tools that might inspect command-line arguments.