Windows Process Creation: Obfuscated PowerShell via VAR++ Launcher (Invoke-Obfuscation)

title: "Windows Process Creation: Obfuscated PowerShell via VAR++ Launcher (Invoke-Obfuscation)"
id: 16c3fb78-a52e-4374-9f54-136a9ce2c742
status: test
description: This rule identifies Windows process creation events where the command line contains patterns consistent with VAR++ launcher style obfuscation used to run PowerShell through Invoke-Expression. Attackers commonly use this behavior to hide PowerShell payload intent and reduce the chance of signature-based detection. The detection relies on process creation telemetry, specifically matching required substrings within the command line that indicate the obfuscated PowerShell execution chain.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-11-16
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "&&set"
      - cmd
      - /c
      - -f
    CommandLine|contains:
      - "{0}"
      - "{1}"
      - "{2}"
      - "{3}"
      - "{4}"
      - "{5}"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e9f55347-2928-4c06-88e5-1a7f8169942e
    type: derived