Rule Info
Description
Detects suspicious ways to obfuscate PowerShell scripts
Tags
['SCRIPT', 'T1027', 'SUSP', 'T1086', 'OBFUS', 'T1059_001']
Date
2022-04-19
Required Modules
[]
Rule Hash
25f127a7ae18aa63212a119920928ace
Score
85
Av Ratio
13.43
Name
SUSP_PS1_OBFUSC_Apr22_1
Author
Florian Roth
Minimum Yara
1.7
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
8
Suspicious (< 10 engines)
20
Clean (0 engines)
6
Rule Matches
Total
Timestamp
Hash
Positives
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR