Powershell Token Obfuscation - Process Creation

Title: Powershell Token Obfuscation - Process Creation
Status: test
Description:Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
References:
  -https://github.com/danielbohannon/Invoke-Obfuscation
Author: frack113
Date: 2022-12-27
modified:2026-03-16
Tags:

• -'attack.stealth'
• -'attack.t1027.009'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
CommandLine|re:'\w+`(?:\w+|-|.)`[\w+|\s]' CommandLine|re:'"(?:\{\d\})+"\s*-f' CommandLine|re:'(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'   filter_main_envpath:
    CommandLine|contains: '${env:path}'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high