PowerShell Command Obfuscation via Invoke-Expression

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•8

This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.