Rule Info
Name
SUSP_OBFUSC_PS1_Quote_IWR_Jan26
Author
MalGamy
Description
Detects suspicious PowerShell scripts that use obfuscated quotes in IWR commands
Score
75
Date
2026-01-30
Minimum Yara
3.5.0
Rule Hash
82b3e382ae0a22f9852f0b22b47d60cc
Tags
['SCRIPT', 'OBFUS', 'T1059_001', 'SUSP', 'T1027']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
8
Suspicious (< 10 engines)
0
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR