Windows PowerShell Obfuscated IEX Invocation Pattern from Invoke-Obfuscation

title: Windows PowerShell Obfuscated IEX Invocation Pattern from Invoke-Obfuscation
id: 57577c3e-766b-41c6-a20b-29e1250173ea
status: test
description: This rule flags PowerShell process executions whose command lines match specific string patterns associated with obfuscated IEX invocation generated by the Invoke-Obfuscation framework. Obfuscated script invocation is commonly used to hinder analysis and evade detections by transforming meaningful code into less readable forms. The rule relies on process creation telemetry with the full CommandLine field to identify these characteristic obfuscation fragments.
references:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml
author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community, Huntrule Team
date: 2019-11-08
modified: 2026-03-16
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[
    - CommandLine|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[
    - CommandLine|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[
    - CommandLine|re: \$env:ComSpec\[(?:\s*\d{1,3}\s*,){2}
    - CommandLine|re: \*mdr\*\W\s*\)\.Name
    - CommandLine|re: \$VerbosePreference\.ToString\(
    - CommandLine|re: \[String\]\s*\$VerbosePreference
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4bf943c6-5146-4273-98dd-e958fd1e3abf
    type: derived