Detectionlowtest

Potential PowerShell Obfuscation Using Character Join

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Mon Jan 09e8314f79-564d-4f79-bc13-fbc0bf2660d8windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        # Example:
        #   Set-Alias -Name Y -Value (-join("Ne","w-O","bje","ct"))
        #   Set-Alias -Name X -Value (-join("Inv","oke","-","Exp","ression"))
        ScriptBlockText|contains|all:
            - '-Alias' # For both "New-Alias" and "Set-Alias"
            - ' -Value (-join('
    condition: selection