Rule Info
Name
Indicator of Obfuscated HTTP/HTTPS URL in PowerShell Script
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects PowerShell script blocks containing an obfuscated HTTP or HTTPS URL.
Threat actors encode download URLs using a wide range of obfuscation techniques
to evade AMSI and string-based detections. Any single match is a reliable
indicator of deliberate obfuscation.
Reference
Internal Research
Date
2026-10-08 00:00:00
Modified
None
Id
0d5405fb-925b-4109-accd-010f7e22e625
Tags
attack.execution attack.stealth attack.t1027
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR