Obfuscated PowerShell OneLiner Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 17, 2025•1•0•14

Detects the execution of obfuscated PowerShell one-liners designed to download and execute PowerShell modules in memory. This rule specifically looks for PowerShell command lines containing a URL (e.g., 'http://127.0.0.1'), the 'IRM' (Invoke-RestMethod) alias within a loop ('%{(IRM $_)}'), and the 'Invoke' keyword, which are indicative of in-memory module execution.