Potential PowerShell Command Line Obfuscation
This rule detects PowerShell command lines that exhibit characteristics of obfuscation by looking for repeated special characters such as '+', '{', '^', and '`'. These patterns are commonly used by adversaries to evade detection by making the command less readable or to bypass signature-based defenses. The rule specifically targets PowerShell (powershell.exe) and PowerShell Core (pwsh.exe) processes.
Sigma
