{"id":"deb9b646-a508-44ee-b7c9-d8965921c6b6","title":"Powershell Token Obfuscation - Process Creation","description":"Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation","author":"frack113","status":"test","level":"high","date":"2022-12-27","modified":"2026-03-16","tags":["attack.stealth","attack.t1027.009"],"technique_ids":["T1027.009"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/danielbohannon/Invoke-Obfuscation"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml","source_sha256":"b80a4c0e27b2c5c6eb93d62312e8a7cba04ad045f3b57db82c28d06b7dd9208b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Powershell Token Obfuscation - Process Creation\nid: deb9b646-a508-44ee-b7c9-d8965921c6b6\nrelated:\n    - id: f3a98ce4-6164-4dd4-867c-4d83de7eca51\n      type: similar\nstatus: test\ndescription: Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation\nreferences:\n    - https://github.com/danielbohannon/Invoke-Obfuscation\nauthor: frack113\ndate: 2022-12-27\nmodified: 2026-03-16\ntags:\n    - attack.stealth\n    - attack.t1027.009\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # Examples:\n        #   IN`V`o`Ke-eXp`ResSIOn (Ne`W-ob`ject Net.WebClient).DownloadString\n        #   &('In'+'voke-Expressi'+'o'+'n') (.('New-Ob'+'jec'+'t') Net.WebClient).DownloadString\n        #   &(\"{2}{3}{0}{4}{1}\"-f 'e','Expression','I','nvok','-') (&(\"{0}{1}{2}\"-f'N','ew-O','bject') Net.WebClient).DownloadString\n        - CommandLine|re: '\\w+`(?:\\w+|-|.)`[\\w+|\\s]'\n        # - CommandLine|re: '\\((\\'(\\w|-|\\.)+\\'\\+)+\\'(\\w|-|\\.)+\\'\\)' TODO: fixme\n        - CommandLine|re: '\"(?:\\{\\d\\})+\"\\s*-f'\n        #   ${e`Nv:pATh}\n        - CommandLine|re: '(?i)\\$\\{`?e`?n`?v`?:`?p`?a`?t`?h`?\\}'\n    filter_main_envpath:\n        CommandLine|contains: '${env:path}'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.009","id":"T1027.009","name":"Embedded Payloads","page":"techniques/enterprise/T1027.009/"}],"data_path":"data/detection-rules/deb9b646-a508-44ee-b7c9-d8965921c6b6.json","kind":"sigma"}