Invoke-Obfuscation CLIP+ Launcher - Security

 1title: Invoke-Obfuscation CLIP+ Launcher - Security
 2id: 4edf51e1-cb83-4e1a-bc39-800e396068e3
 3related:
 4    - id: f7385ee2-0e0c-11eb-adc1-0242ac120002
 5      type: derived
 6status: test
 7description: Detects Obfuscated use of Clip.exe to execute PowerShell
 8references:
 9    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
10author: Jonathan Cheong, oscd.community
11date: 2020-10-13
12modified: 2022-11-27
13tags:
14    - attack.defense-evasion
15    - attack.t1027
16    - attack.execution
17    - attack.t1059.001
18
19logsource:
20    product: windows
21    service: security
22    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
23detection:
24    selection:
25        EventID: 4697
26        ServiceFileName|contains|all:
27            - 'cmd'
28            - '&&'
29            - 'clipboard]::'
30    condition: selection
31falsepositives:
32    - Unknown
33level: high

References

• Invoke-Obfuscation · Issue #1009 · SigmaHQ/sigma

  

  Summary Tool: Invoke-Obfuscation — PowerShell command and script obfuscation framework Author: Daniel Bohannon, @danielhbohannon Type: Offensive tool, threat simulation Materials: The Invoke-Obfusc...

  
  Read More

Related rules

• ConvertTo-SecureString Cmdlet Usage Via CommandLine
• Invoke-Obfuscation CLIP+ Launcher
• Invoke-Obfuscation CLIP+ Launcher - PowerShell
• Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
• Invoke-Obfuscation CLIP+ Launcher - System