Skip to content
Threat Feed

Tag

Obfuscation

12 briefs RSS
low advisory

Potential PowerShell Obfuscated Script via High Entropy

This detection identifies potentially obfuscated PowerShell scripts based on high entropy and non-uniform character distributions, often used by attackers to evade signature-based detections and hinder analysis.

Microsoft Intune Management Extension +2 defense-evasion powershell obfuscation
2r 3t
high advisory

Right-to-Left Override Character Used for Defense Evasion

Adversaries are using the Right-to-Left Override (RTLO) character (U+202E) in command-line arguments to obfuscate malicious file names and trick users into executing them, achieving defense evasion.

defense-evasion obfuscation
2r 1t
medium advisory

Detection of Obfuscated IP Address Usage in Download Commands

This brief details the use of obfuscated IP addresses within download commands, often employed to evade detection by hiding the true destination of malicious downloads.

Windows discovery evasion obfuscation
2r 2t
high advisory

Detection of Invoke-Obfuscation via Standard Input

This brief outlines detection strategies for adversaries leveraging Invoke-Obfuscation techniques within PowerShell scripts executed via standard input, a method commonly used to evade traditional detection mechanisms.

Windows defense-evasion obfuscation powershell
2r 2t
high advisory

PowerShell Obfuscation via Concatenated Dynamic Command Invocation

This rule detects PowerShell scripts that build commands from concatenated string literals within dynamic invocation constructs, a technique used by attackers to obscure execution intent, bypass keyword-based detections, and evade AMSI.

Elastic License v2 defense-evasion powershell obfuscation
2r 1t
high advisory

Invoke-Obfuscation via Clip.exe

The use of `clip.exe` in conjunction with PowerShell and command-line obfuscation is used to evade detection.

Windows defense-evasion execution obfuscation
2r 2t
high advisory

PowerShell Obfuscation via String Concatenation

This rule detects PowerShell scripts employing string concatenation to evade static analysis and AMSI by fragmenting keywords or URLs at runtime.

PowerShell defense-evasion obfuscation windows
2r 1t
high advisory

PowerShell Obfuscation via Character Array Reconstruction

Detects PowerShell scripts using character array reconstruction to hide commands, URLs, or payloads, evading static analysis and AMSI.

powershell obfuscation defense-evasion windows
2r 1t
medium advisory

Potential PowerShell Obfuscation via Special Character Overuse

This rule detects PowerShell scripts heavily obfuscated with whitespace and special characters, often used to evade static analysis and AMSI, by identifying scripts with low symbol diversity and a high proportion of whitespace and special characters.

powershell obfuscation defense-evasion windows
2r 3t
high advisory

Invoke-Obfuscation Obfuscated IEX Invocation via PowerShell

Attackers use Invoke-Obfuscation, a PowerShell obfuscation framework, to generate obfuscated IEX (Invoke-Expression) commands, evading detection and executing malicious code.

Windows defense-evasion execution powershell obfuscation
2r 2t
high advisory

Command Obfuscation via Unicode Modifier Letters

Adversaries use Unicode modifier letters to obfuscate command-line arguments, evading string-based detections on common Windows utilities like PowerShell and cmd.exe.

Microsoft Defender XDR +5 defense-evasion command-line unicode obfuscation
2r 1t
high advisory

PowerShell Obfuscation via Backtick-Escaped Variable Expansion

PowerShell scripts use backtick-escaped characters inside `${}` variable expansion to reconstruct strings at runtime, enabling attackers to split keywords, hide commands, and evade static analysis and AMSI.

windows +1 powershell obfuscation defense-evasion variable-expansion
2r 1t