Tool

github.com/SigmaHQ/sigma/issues/1009

https://github.com/SigmaHQ/sigma/issues/1009

Published on: github.com

ATT&CK techniques those detections carry

T1027Obfuscated Files or Information
T1059.001PowerShell
T1218.011Rundll32

50 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Suspicious ShellExec_RunDLL Call Via Ordinal	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Usage Of ShellExec_RunDLL	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use MSHTA	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use Clip	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Stdin	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation COMPRESS OBFUSCATION	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation VAR+ Launcher	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation STDIN+ Launcher	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation CLIP+ Launcher	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use Rundll32 - PowerShell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use MSHTA - PowerShell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use Clip - Powershell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Stdin - Powershell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation VAR+ Launcher - PowerShell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation STDIN+ Launcher - Powershell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation CLIP+ Launcher - PowerShell	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use MSHTA - PowerShell Module	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Use Clip - PowerShell Module	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Invoke-Obfuscation Via Stdin - PowerShell Module	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 25 of 50

Filter in the catalogue