
Summary
This detection rule is designed to identify potentially obfuscated PowerShell scripts that exhibit an unusually high proportions of whitespace and special characters. Such characteristics may indicate the deliberate obfuscation of code to evade detection by security mechanisms, including static analysis processes and Advanced Malware Protection (AMSI) checks. The rule specifically looks for scripts that are longer than 1000 characters, checking for a ratio of non-standard characters that exceeds 75% of the total length, which often indicates potential malicious intent. The implementation requires that PowerShell Script Block Logging is enabled to generate the necessary logs for this detection. Instructions for enabling this logging are provided in the rule's setup section. The rule falls under the categories of Defense Evasion and Threat Detection, contributing towards the cybersecurity efforts against sophisticated scripting attacks.
Categories
- Endpoint
- Windows
Data Sources
- Process
- File
- Application Log
- Network Traffic
ATT&CK Techniques
- T1027
- T1140
- T1059
- T1059.001
Created: 2025-04-16