Suspicious PowerShell Command Line Obfuscation and Execution

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•11•0•22

Detects highly obfuscated PowerShell command lines that utilize various encoding and execution techniques, often indicative of malicious activity. The rule scores different obfuscation methods (XOR, Hex, Base64), execution methods (ScriptBlock, IEX), and payload indicators (URLs, download functions). A high total score and specific thresholds for execution and obfuscation trigger the alert. It also considers suspicious parent processes like browsers or scripting hosts.