Powershell Token Obfuscation - Powershell

Title: Powershell Token Obfuscation - Powershell
Status: test
Description:Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
References:
  -https://github.com/danielbohannon/Invoke-Obfuscation
Author: frack113
Date: 2022-12-27
modified:2023-03-24
Tags:

• -'attack.defense-evasion'
• -'attack.t1027.009'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
ScriptBlockText|re:'\w+`(\w+|-|.)`[\w+|\s]' ScriptBlockText|re:'"(\{\d\}){2,}"\s*-f' ScriptBlockText|re:'(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'   filter_envpath:
    ScriptBlockText|contains: '${env:path}'
  filter_chocolatey:
    ScriptBlockText|contains:
      -'it will return true or false instead'
      -'The function also prevents `Get-ItemProperty` from failing'

  filter_exchange:
    Path|startswith: 'C:\Program Files\Microsoft\Exchange Server\'
    Path|endswith: '\bin\servicecontrol.ps1'
    ScriptBlockText|contains: '`r`n'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Unknown
Level: high