Potential Commandline Obfuscation Using Escape Characters
Detects potential command-line obfuscation techniques using escape characters, specifically looking for 'h^t^t^p' or 'h"t"t"p' patterns in process command lines. This method is often used by adversaries to evade detection by security tools that might be looking for cleartext indicators like URLs.
Sigma
