Invoke-Obfuscation Via Use Clip - System
Detects Obfuscated Powershell via use Clip.exe in Scripts
Sigma rule (View on GitHub)
1title: Invoke-Obfuscation Via Use Clip - System
2id: 63e3365d-4824-42d8-8b82-e56810fefa0c
3status: test
4description: Detects Obfuscated Powershell via use Clip.exe in Scripts
5references:
6 - https://github.com/SigmaHQ/sigma/issues/1009 # (Task29)
7author: Nikita Nazarov, oscd.community
8date: 2020-10-09
9modified: 2022-11-29
10tags:
11 - attack.defense-evasion
12 - attack.t1027
13 - attack.execution
14 - attack.t1059.001
15logsource:
16 product: windows
17 service: system
18detection:
19 selection:
20 Provider_Name: 'Service Control Manager'
21 EventID: 7045
22 ImagePath|contains: '(Clipboard|i'
23 condition: selection
24falsepositives:
25 - Unknown
26level: high
References
Related rules
- ConvertTo-SecureString Cmdlet Usage Via CommandLine
- Invoke-Obfuscation CLIP+ Launcher
- Invoke-Obfuscation CLIP+ Launcher - PowerShell
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
- Invoke-Obfuscation CLIP+ Launcher - Security