Rule Info
Name
Invocation of Obfuscated URL In CommandLine
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution where the command line contains an obfuscated HTTP or HTTPS URL.
Threat actors encode download URLs using a wide range of obfuscation techniques - to evade AMSI and string-based detections.
Any single match is a reliable indicator of deliberate obfuscation.
Reference
Internal Research
Date
2026-10-08 00:00:00
Modified
None
Id
2ef9faf3-3c62-4172-a84b-4fa4aff35b7f
Tags
attack.execution attack.stealth attack.t1027.010
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR