Obfuscation

Detection of command-line obfuscation where attackers insert excessive whitespace sequences to evade signature-based security monitoring tools.

Adversaries utilize ROT-encoded Python scripts within packages to obfuscate malicious logic and evade security analysis on Windows and macOS systems.

Detection logic for identifying PowerShell execution utilizing excessive special characters for command line obfuscation to bypass security monitoring.

This brief documents a detection method for identifying potentially malicious PowerShell scripts that decode base64-encoded Gzip archives to facilitate in-memory code execution.

Adversaries utilize PowerShell parameter substring truncation to evade command-line monitoring by leveraging the built-in ability of PowerShell to parse shortened, non-standard parameter names.

This brief documents the use of the 'FromBase64String' method within PowerShell command lines, a common technique for obfuscating malicious payloads to bypass signature-based detection.

Detection of the ConvertTo-SecureString cmdlet usage via command-line, which is often used in adversarial scripts to handle credentials or obfuscated strings.

Detection of malicious PowerShell execution patterns involving Base64 encoded commands, frequently utilized by malware families such as Emotet for obfuscated payload delivery.

This brief documents detection logic for PowerShell command-line obfuscation methods commonly utilized by the Invoke-Obfuscation framework to bypass security monitoring.

A 12 KB Windows backdoor evades traditional detection by storing its command-and-control infrastructure within hidden whitespace characters inside standard desktop.ini configuration files.

FortiGuard Labs analyzed a new TrickBot variant that employs DNS tunneling for command and control communications, modular execution, and incorporates persistence and obfuscation techniques to evade detection and maintain presence on infected systems.

This brief details the detection of Base64 encoded PowerShell `Invoke-` keywords in command lines, a common stealth technique leveraged by malware families such as Gootloader for initial access, execution, and subsequent payload delivery, enabling evasive command and control.

This detection identifies potentially obfuscated PowerShell scripts based on high entropy and non-uniform character distributions, often used by attackers to evade signature-based detections and hinder analysis.

Adversaries are using the Right-to-Left Override (RTLO) character (U+202E) in command-line arguments to obfuscate malicious file names and trick users into executing them, achieving defense evasion.

This analytic detects the execution of Python scripts employing ROT encoding for letter substitution, a technique used by adversaries to obfuscate malicious code within legitimate Python packages on Windows and macOS systems.

This rule detects suspicious PowerShell arguments often used during malware installation, including encoded commands, file downloads, and obfuscation techniques.

This brief details the use of obfuscated IP addresses within download commands, often employed to evade detection by hiding the true destination of malicious downloads.

This rule detects potential PowerShell obfuscated scripts by identifying script blocks with high entropy and non-uniform character distributions, which attackers use to evade signature-based detections.

This brief outlines detection strategies for adversaries leveraging Invoke-Obfuscation techniques within PowerShell scripts executed via standard input, a method commonly used to evade traditional detection mechanisms.

This rule detects PowerShell scripts that build commands from concatenated string literals within dynamic invocation constructs, a technique used by attackers to obscure execution intent, bypass keyword-based detections, and evade AMSI.

The use of `clip.exe` in conjunction with PowerShell and command-line obfuscation is used to evade detection.

This rule detects PowerShell scripts employing string concatenation to evade static analysis and AMSI by fragmenting keywords or URLs at runtime.

Detects PowerShell scripts using character array reconstruction to hide commands, URLs, or payloads, evading static analysis and AMSI.

This detection identifies Windows PowerShell processes implementing manual Base64 decoding, a technique used by threat actors to obfuscate malicious payloads and evade standard detection mechanisms.

This rule detects PowerShell scripts heavily obfuscated with whitespace and special characters, often used to evade static analysis and AMSI, by identifying scripts with low symbol diversity and a high proportion of whitespace and special characters.

Attackers use Invoke-Obfuscation, a PowerShell obfuscation framework, to generate obfuscated IEX (Invoke-Expression) commands, evading detection and executing malicious code.

PowerShell scripts use backtick-escaped characters inside `${}` variable expansion to reconstruct strings at runtime, enabling attackers to split keywords, hide commands, and evade static analysis and AMSI.