Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects obfuscated PowerShell commands executed via `cmd.exe` using the VAR++ LAUNCHER technique. This method involves using `cmd.exe`'s `&&set` command to define variables that are then used in conjunction with string formatting (`-f` and `{0}` style placeholders) to construct and execute PowerShell commands, often involving `Invoke-Expression` and `DownloadString` for remote code execution.