YARA · SecuInfra Falcon Team

SECUINFRA_OBFUS_Powershell_Execution

Detects some variations of obfuscated PowerShell code to execute further PowerShell code

What this rule detects

Detects some variations of obfuscated PowerShell code to execute further PowerShell code

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Author: SECUINFRA Falcon Team

Source repository: SecuInfra Falcon Team @ 2d7c66d7d1

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b32c2a92-599c-5916-a335-dc996dcdc1bf

Tags:FILE

SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Reverse_Run_KeyMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27