Suspicious XOR Encoded PowerShell Command

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.