{"id":"b222df08-0e07-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-17","tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"technique_ids":["T1027","T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/SigmaHQ/sigma/issues/1009"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml","source_sha256":"b43bfec3a6a788bef77f78affdb34783e17002744019976d4e5d980a7b6684e2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Invoke-Obfuscation CLIP+ Launcher\nid: b222df08-0e07-11eb-adc1-0242ac120002\nstatus: test\ndescription: Detects Obfuscated use of Clip.exe to execute PowerShell\nreferences:\n    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)\nauthor: Jonathan Cheong, oscd.community\ndate: 2020-10-13\nmodified: 2022-11-17\ntags:\n    - attack.stealth\n    - attack.t1027\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # CommandLine|re: 'cmd.{0,5}(?:\\/c|\\/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\\\"\\{\\d\\}.+\\-f.+\\\"'\n        # Example 1: Cmd /c\" echo/Invoke-Expression (New-Object Net.WebClient).DownloadString |cLiP&& POWerSheLl -Nolog -sT . (\\\"{1}{2}{0}\\\"-f'pe','Ad',(\\\"{1}{0}\\\" -f'Ty','d-' ) ) -Assemb ( \\\"{5}{1}{3}{0}{2}{4}\\\" -f'ows','y','.F',(\\\"{0}{1}{2}\\\" -f'stem.W','i','nd'),( \\\"{0}{1}\\\"-f 'o','rms' ),'S' ) ; ([SySTEM.wiNDows.FoRmS.CLiPbOArd]::( \\\"{1}{0}\\\" -f (\\\"{1}{0}\\\" -f'T','TTeX' ),'gE' ).\\\"invO`Ke\\\"( ) ) ^| ^&( \\\"{5}{1}{2}{4}{3}{0}\\\" -f 'n',( \\\"{1}{0}\\\"-f'KE-','o' ),(\\\"{2}{1}{0}\\\"-f 'pRESS','x','e' ),'o','i','iNV') ; [System.Windows.Forms.Clipboard]::(\\\"{0}{1}\\\" -f( \\\"{1}{0}\\\"-f'e','SetT' ),'xt').\\\"InV`oKe\\\"( ' ')\"\n        # Example 2: CMD/c \" ECho Invoke-Expression (New-Object Net.WebClient).DownloadString|c:\\WiNDowS\\SySteM32\\cLip && powershElL -noPRO -sTa ^& (\\\"{2}{0}{1}\\\" -f 'dd',(\\\"{1}{0}\\\"-f 'ype','-T' ),'A' ) -AssemblyN (\\\"{0}{3}{2}{1}{4}\\\"-f'Pr','nCo',(\\\"{0}{1}\\\"-f'e','ntatio'),'es','re' ) ; ^& ( ( [StRinG]${ve`RB`OSE`pr`e`FeReNCE} )[1,3] + 'x'-JoiN'') ( ( [sySTem.WInDOWs.ClipbOaRD]::( \\\"{1}{0}\\\" -f(\\\"{0}{1}\\\" -f'tTe','xt' ),'ge' ).\\\"IN`Vo`Ke\\\"( ) ) ) ; [System.Windows.Clipboard]::( \\\"{2}{1}{0}\\\" -f't',( \\\"{0}{1}\\\" -f 'tT','ex' ),'Se' ).\\\"In`V`oKe\\\"( ' ' )\"\n        CommandLine|contains|all:\n            - 'cmd'\n            - '&&'\n            - 'clipboard]::'\n            - '-f'\n        CommandLine|contains:\n            - '/c'\n            - '/r'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/b222df08-0e07-11eb-adc1-0242ac120002.json","kind":"sigma"}