Potential PowerShell Obfuscation Via Reversed Commands

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers