PowerShell Base64 Encoded Invoke Keyword Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•31

This rule detects PowerShell execution where the command line contains Base64 encoded strings that decode to 'Invoke-' keywords. It specifically looks for both UTF-8 and UTF-16 Little Endian (LE) encodings of 'Invoke-' when PowerShell or pwsh.exe is executed with the '-e' (encoded command) flag. This technique is commonly used by adversaries to obfuscate malicious PowerShell commands.