Sigma rule: Invoke-Obfuscation VAR+ Launcher

Rule

Title

Invoke-Obfuscation VAR+ Launcher

Status

test

Level

high

Author

Jonathan Cheong, oscd.community

Date

2020-10-15

Modified

2024-04-15

File

rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Obfuscated use of Environment Variables to execute PowerShell

Log source

product

windows

category

process_creation

Detection

selection:
    # Example 1: C:\winDoWs\SySTeM32\cmd.Exe /C"SET NOtI=Invoke-Expression (New-Object Net.WebClient).DownloadString&& PowERshElL -NOl SET-iteM ( 'VAR' + 'i'+ 'A' + 'blE:Ao6' + 'I0') ( [TYpe](\"{2}{3}{0}{1}\"-F 'iRoN','mENT','e','nv') ) ; ${exECUtIONCOnTEXT}.\"IN`VO`KecOmMaND\".\"inVo`KES`crIPt\"( ( ( GEt-VAriAble ( 'a' + 'o6I0') -vaLU )::(\"{1}{4}{2}{3}{0}\" -f'e','gETenvIR','NtvaRIa','BL','ONme' ).Invoke(( \"{0}{1}\"-f'n','oti' ),( \"{0}{1}\" -f'pRoC','esS') )) )"
    # Example 2: cMD.exe /C "seT SlDb=Invoke-Expression (New-Object Net.WebClient).DownloadString&& pOWErShell .(( ^&(\"{1}{0}{2}{3}\" -f 'eT-vaR','G','iab','lE' ) (\"{0}{1}\" -f '*m','DR*' ) ).\"na`ME\"[3,11,2]-JOIN'' ) ( ( ^&(\"{0}{1}\" -f'g','CI' ) (\"{0}{1}\" -f 'ENV',':SlDb' ) ).\"VA`luE\" ) "
    CommandLine|re: 'cmd.{0,5}(?:/c|/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\"'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1027
• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1027
• T1059.001

References

• https://github.com/SigmaHQ/sigma/issues/1009

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml