heroui logo

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Sigma Rules

View Source
Summary
This detection rule identifies the use of obfuscated PowerShell commands that are invoked through the VAR++ LAUNCHER. It targets specific command line arguments typically associated with command injection and obfuscation techniques, particularly focusing on patterns that include various command line overrides like 'cmd /c', and concatenated statements using '&&'. The detection mechanism looks for certain substrings in the command line that are indicative of attempts to obscure the intent or origin of the PowerShell execution. The rule is categorized under high severity, reflecting its significance in identifying potentially malicious behavior during the execution of processes on Windows systems.
Categories
  • Windows
  • Endpoint
Data Sources
  • Process
Created: 2020-10-13