huntrule

Windows PowerShell script token obfuscation via backtick and dynamic expression patterns

Find PowerShell script blocks that show token obfuscation patterns resembling Invoke-Obfuscation behavior.

FreeReviewedSigma · Medium · v5
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-12-27
Updated
2026-07-31
AnalysisDetection
title: Windows PowerShell script token obfuscation via backtick and dynamic expression patterns
id: ec71a474-625c-4372-9e79-eaff62f19df6
related:
  - id: deb9b646-a508-44ee-b7c9-d8965921c6b6
    type: similar
  - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51
    type: derived
status: test
description: This rule flags PowerShell script block content that matches token obfuscation patterns associated with Invoke-Obfuscation-style transformations. Attackers use these techniques to make malicious commands harder to read and signatures easier to evade, increasing the chance of script-based intrusion and persistence. The detection relies on Script Block Logging telemetry and matches obfuscated script text patterns while excluding specific known benign contexts.
references:
  - https://github.com/danielbohannon/Invoke-Obfuscation
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml
author: frack113, Huntrule Team
date: 2022-12-27
modified: 2025-10-19
tags:
  - attack.stealth
  - attack.t1027.009
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    - ScriptBlockText|re: \w+`(\w+|-|.)`[\w+|\s]
    - ScriptBlockText|re: '"(\{\d\}){2,}"\s*-f'
    - ScriptBlockText|re: (?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}
  filter_envpath:
    ScriptBlockText|contains: ${env:path}
  filter_chocolatey:
    ScriptBlockText|contains:
      - it will return true or false instead
      - The function also prevents `Get-ItemProperty` from failing
  filter_exchange:
    Path|startswith: C:\Program Files\Microsoft\Exchange Server\
    Path|endswith: \bin\servicecontrol.ps1
    ScriptBlockText|contains: "`r`n"
  condition: selection and not 1 of filter_*
falsepositives:
  - Edge case might be possible with heavy use of string formatting or obfuscation in legitimate scripts.
level: medium
license: DRL-1.1