Suspicious PowerShell Invoke-Expression (IEX) Execution Patterns

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.