Sigma Rules

bXOR Operator Usage In PowerShell Command Line - PowerShell Classic

Detects powershell execution with that make use of to the bxor (Bitwise XOR). Attackers might use as an alternative obfuscation method to Base64 encoded commands. Investigate the CommandLine and process tree to determine if the activity is malicious.