Suspicious Obfuscated PowerShell Code

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects suspicious PowerShell code that is UTF16 and base64 encoded, often used in command lines for obfuscation. The rule specifically looks for patterns indicative of obfuscated PowerShell, such as '-bxor 0x', '.Invoke() |', and format string patterns like '{1}{0}" -f' or '{0}{3}" -f' in their encoded forms.