Sigma rule: Powershell Token Obfuscation - Process Creation

Rule

Title

Powershell Token Obfuscation - Process Creation

Status

test

Level

high

Author

frack113

Date

2022-12-27

Modified

2026-03-16

File

rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Log source

product

windows

category

process_creation

Detection

selection:
    # Examples:
    #   IN`V`o`Ke-eXp`ResSIOn (Ne`W-ob`ject Net.WebClient).DownloadString
    #   &('In'+'voke-Expressi'+'o'+'n') (.('New-Ob'+'jec'+'t') Net.WebClient).DownloadString
    #   &("{2}{3}{0}{4}{1}"-f 'e','Expression','I','nvok','-') (&("{0}{1}{2}"-f'N','ew-O','bject') Net.WebClient).DownloadString
    - CommandLine|re: '\w+`(?:\w+|-|.)`[\w+|\s]'
    # - CommandLine|re: '\((\'(\w|-|\.)+\'\+)+\'(\w|-|\.)+\'\)' TODO: fixme
    - CommandLine|re: '"(?:\{\d\})+"\s*-f'
    #   ${e`Nv:pATh}
    - CommandLine|re: '(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'
filter_main_envpath:
    CommandLine|contains: '${env:path}'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1027.009

MITRE ATT&CK ids this rule names

• T1027.009

Related rules

• f3a98ce4-6164-4dd4-867c-4d83de7eca51 (similar)

References

• https://github.com/danielbohannon/Invoke-Obfuscation

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml