Potential PowerShell Obfuscation Via Reversed Commands
Detects the execution of PowerShell commands that contain reversed strings, a common obfuscation technique used by attackers to evade detection. The rule specifically looks for PowerShell or pwsh.exe processes where the command line contains reversed versions of common PowerShell keywords or commands, while excluding commands that use standard encoded command parameters to reduce false positives.
Sigma
