PowerShell Script Block Token Obfuscation via Invoke-Obfuscation Patterns

title: PowerShell Script Block Token Obfuscation via Invoke-Obfuscation Patterns
id: ec71a474-625c-4372-9e79-eaff62f19df6
related:
  - id: deb9b646-a508-44ee-b7c9-d8965921c6b6
    type: similar
  - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51
    type: derived
status: test
description: This rule flags PowerShell script blocks containing token obfuscation patterns consistent with Invoke-Obfuscation usage. Such obfuscation can help attackers evade static detection and hinder analysis by altering token formatting, expression construction, and environment variable casing. The detection relies on Script Block Logging telemetry, matching regular expressions against ScriptBlockText and applying environment- and application-specific filters to reduce common benign cases.
references:
  - https://github.com/danielbohannon/Invoke-Obfuscation
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml
author: frack113, Huntrule Team
date: 2022-12-27
modified: 2025-10-19
tags:
  - attack.stealth
  - attack.t1027.009
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    - ScriptBlockText|re: \w+`(\w+|-|.)`[\w+|\s]
    - ScriptBlockText|re: '"(\{\d\}){2,}"\s*-f'
    - ScriptBlockText|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}
  filter_envpath:
    ScriptBlockText|contains: ${env:path}
  filter_chocolatey:
    ScriptBlockText|contains:
      - it will return true or false instead
      - The function also prevents `Get-ItemProperty` from failing
  filter_exchange:
    Path|startswith: C:\Program Files\Microsoft\Exchange Server\
    Path|endswith: \bin\servicecontrol.ps1
    ScriptBlockText|contains: "`r`n"
  condition: selection and not 1 of filter_*
falsepositives:
  - Edge case might be possible with heavy use of string formatting or obfuscation in legitimate scripts.
level: medium
license: DRL-1.1