Potential PowerShell Obfuscation Via WCHAR/CHAR

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•14

Detects suspicious encoded character syntax often used in PowerShell for defense evasion, specifically looking for '[char]0x' or '(WCHAR)0x' in command lines, which are common methods to obfuscate commands.