SUSP_Obfuscted_PowerShell_Code

Description

Detects obfuscated PowerShell Code

Query · yara

strings:
      $s1 = "').Invoke(" ascii
      $s2 = "(\"{1}{0}\"" ascii
      $s3 = "{0}\" -f" ascii
   condition:
      #s1 > 11 and #s2 > 10 and #s3 > 10
Raw source SUSP_Obfuscted_PowerShell_Code · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule SUSP_Obfuscted_PowerShell_Code {
   meta:
      description = "Detects obfuscated PowerShell Code"
      date = "2018-12-13"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/silv0123/status/1073072691584880640"
      id = "e2d8fc9e-ce2b-5118-8305-0d5839561d4f"
   strings:
      $s1 = "').Invoke(" ascii
      $s2 = "(\"{1}{0}\"" ascii
      $s3 = "{0}\" -f" ascii
   condition:
      #s1 > 11 and #s2 > 10 and #s3 > 10
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.