Potential PowerShell Obfuscation Via WCHAR/CHAR

Title: Potential PowerShell Obfuscation Via WCHAR/CHAR
Status: test
Description:Detects suspicious encoded character syntax often used for defense evasion
References:
  -https://twitter.com/0gtweet/status/1281103918693482496
Author: Florian Roth (Nextron Systems)
Date: 2020-07-09
modified:2025-03-03
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.001'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'[char]0x'
      -'(WCHAR)0x'

  condition:selection
Falsepositives:
  -Unknown
Level: high