Detection of Suspicious Command-Line Obfuscation Techniques

Shadows VMB@Vemorian_Mort

•updated Sep 13, 2026•7•0•15

This rule monitors process creation events for common command-line obfuscation patterns used to evade detection. It flags suspicious usage of encoding (e.g., base64), character manipulation (e.g., caret char insertion, case randomization), and scripting-related concatenation or dynamic reassembly techniques within cmd, powershell, or script host commands.