Powershell Token Obfuscation - Process Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects PowerShell command-line obfuscation techniques, specifically those associated with Invoke-Obfuscation, by looking for patterns like backticks, string concatenation, and format string abuse in process command lines. It also includes a specific pattern for obfuscated environment variable access.