huntrule

PowerShell VAR++ LAUNCHER Obfuscation via ScriptBlockText && set with encoded formatting

Detects VAR++ LAUNCHER-like PowerShell obfuscation patterns in ScriptBlockText.

FreeUnreviewedSigmahighv1
title: PowerShell VAR++ LAUNCHER Obfuscation via ScriptBlockText && set with encoded formatting
id: e78f41df-dcb0-43bc-b728-47a34b3d0dfa
status: test
description: This rule flags PowerShell script block content consistent with VAR++ LAUNCHER style obfuscation, specifically patterns using '&& set' combined with encoded formatting and command execution fragments. Such obfuscated scripts are commonly used to conceal malicious logic and evade casual inspection while still executing in PowerShell. It relies on script block logging telemetry that captures the ScriptBlockText field for matching the obfuscation pattern.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|re: (?i)&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c
  condition: selection_4104
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e54f5149-6ba3-49cf-b153-070d24679126
    type: derived

What it detects

This rule flags PowerShell script block content consistent with VAR++ LAUNCHER style obfuscation, specifically patterns using '&& set' combined with encoded formatting and command execution fragments. Such obfuscated scripts are commonly used to conceal malicious logic and evade casual inspection while still executing in PowerShell. It relies on script block logging telemetry that captures the ScriptBlockText field for matching the obfuscation pattern.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.