Windows Security Event 4697: Obfuscated PowerShell IEX Invocation Pattern from Invoke-Obfuscation

title: "Windows Security Event 4697: Obfuscated PowerShell IEX Invocation Pattern from Invoke-Obfuscation"
id: bba8f149-30ae-4ae2-b511-12178b894952
related:
  - id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9
    type: derived
  - id: fd0f5778-d3cb-4c9a-9695-66759d04702a
    type: derived
status: test
description: This rule flags Windows Security audit events (EventID 4697) where the recorded ServiceFileName matches multiple patterns consistent with obfuscated PowerShell execution using IEX. Attackers can use obfuscation to hide malicious script content and complicate analysis while still achieving code execution. The detection relies on the presence of EventID 4697 telemetry and regex-matched substrings within the ServiceFileName field that indicate obfuscated string assembly and IEX-related invocation behavior.
references:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml
author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community, Huntrule Team
date: 2019-11-08
modified: 2022-11-27
tags:
  - attack.stealth
  - attack.t1027
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection_eid:
    EventID: 4697
  selection_servicefilename:
    - ServiceFileName|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[
    - ServiceFileName|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[
    - ServiceFileName|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[
    - ServiceFileName|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2}
    - ServiceFileName|re: \\*mdr\*\W\s*\)\.Name
    - ServiceFileName|re: \$VerbosePreference\.ToString\(
    - ServiceFileName|re: \String\]\s*\$VerbosePreference
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1