Invoke-Obfuscation via Clipboard and PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.