Invoke-Obfuscation Via Use Clip - System
Detects Obfuscated Powershell via use Clip.exe in Scripts
Sigma rule (View on GitHub)
1title: Invoke-Obfuscation Via Use Clip - System
2id: 63e3365d-4824-42d8-8b82-e56810fefa0c
3status: experimental
4description: Detects Obfuscated Powershell via use Clip.exe in Scripts
5references:
6 - https://github.com/SigmaHQ/sigma/issues/1009 #(Task29)
7author: Nikita Nazarov, oscd.community
8date: 2020/10/09
9modified: 2022/11/29
10tags:
11 - attack.defense_evasion
12 - attack.t1027
13 - attack.execution
14 - attack.t1059.001
15logsource:
16 product: windows
17 service: system
18detection:
19 selection:
20 Provider_Name: 'Service Control Manager'
21 EventID: 7045
22 ImagePath|contains: '(Clipboard|i'
23 condition: selection
24falsepositives:
25 - Unknown
26level: high