Powershell Token Obfuscation - Powershell

SIGMA detection rule by frack113 · GPL-2.0

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts. Use this rule as a threat-hunting baseline to find obfuscated scripts in your environment. Once tested and tuned, consider deploying a production detection rule based on this hunting rule.

title: Powershell Token Obfuscation - Powershell
id: 77af6d22-9887-7943-53f1-6a849e2e892d
related:
    - id: deb9b646-a508-44ee-b7c9-d8965921c6b6
      type: similar
    - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51
      type: derived
status: test
description: |
    Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts.
    Use this rule as a threat-hunting baseline to find obfuscated scripts in your environment.
    Once tested and tuned, consider deploying a production detection rule based on this hunting rule.
references:
    - https://github.com/danielbohannon/Invoke-Obfuscation
author: frack113
date: 2022-12-27
modified: 2025-10-19
tags:
    - attack.stealth
    - attack.t1027.009
    - detection.threat-hunting
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    ps_script:
        EventID: 4104
        Channel:
            - Microsoft-Windows-PowerShell/Operational
            - PowerShellCore/Operational
    selection:
        # Examples:
        #   IN`V`o`Ke-eXp`ResSIOn (Ne`W-ob`ject Net.WebClient).DownloadString
        #   &('In'+'voke-Expressi'+'o'+'n') (.('New-Ob'+'jec'+'t') Net.WebClient).DownloadString
        #   &("{2}{3}{0}{4}{1}"-f 'e','Expression','I','nvok','-') (&("{0}{1}{2}"-f'N','ew-O','bject') Net.WebClient).DownloadString
        - ScriptBlockText|re: \w+`(\w+|-|.)`[\w+|\s]
        # - ScriptBlockText|re: '\((\'(\w|-|\.)+\'\+)+\'(\w|-|\.)+\'\)' TODO: fixme
        - ScriptBlockText|re: '"(\{\d\}){2,}"\s*-f'  # trigger on at least two placeholders. One might be used for legitimate string formatting
        #   ${e`Nv:pATh}
        - ScriptBlockText|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}
    filter_envpath:
        ScriptBlockText|contains: ${env:path}   # TODO: Fix this. See https://github.com/SigmaHQ/sigma/pull/4964
    filter_chocolatey:
        ScriptBlockText|contains:
            - it will return true or false instead    # Chocolatey install script https://github.com/chocolatey/chocolatey
            - The function also prevents `Get-ItemProperty` from failing   # https://docs.chocolatey.org/en-us/create/functions/get-uninstallregistrykey
    filter_exchange:
        Path|startswith: C:\Program Files\Microsoft\Exchange Server\
        Path|endswith: \bin\servicecontrol.ps1
        ScriptBlockText|contains: '`r`n'
    condition: ps_script and (selection and not 1 of filter_*)
falsepositives:
    - Edge case might be possible with heavy use of string formatting or obfuscation in legitimate scripts.
level: medium
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d1f67a1a-c1d4-40e8-968e-aedf3d0ea09d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion