Powershell Token Obfuscation - Powershell

ScriptBlockText

'\w+`(\w+|-|.)`[\w+|\s]'

'"(\{\d\}){2,}"\s*-f'

'(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'

'${env:path}'

'it will return true or false instead'

'The function also prevents `Get-ItemProperty` from failing'

'`r`n'

Path

'C:\Program Files\Microsoft\Exchange Server\'

'\bin\servicecontrol.ps1'

Detection Query 1

(resourcename = "Windows Security" AND eventtype in ("4104" ) ) AND rawmessages not in ("C:\\Program Files\\Microsoft\\Exchange Server", "\\bin\\servicecontrol.ps1") AND winmessage in ("\\w+`(\\w+|-|.)`[\\w+|\\s]" ,"(\\{\\d\\}){2,}","\\s*-f" , "(?i)\\$\\{`?e`?n`?v`?:`?p`?a`?t`?h`?\\}" , "${env:path}" , "it will return true or false instead" , "The function also prevents `Get-ItemProperty` from failing" , "`r`n" )

Detection Query 2

(technologygroup = "EDR" ) AND winmessages not in ("C:\\Program Files\\Microsoft\\Exchange Server", "\\bin\\servicecontrol.ps1") AND winmessage in ("\\w+`(\\w+|-|.)`[\\w+|\\s]" ,"(\\{\\d\\}){2,}","\\s*-f" , "(?i)\\$\\{`?e`?n`?v`?:`?p`?a`?t`?h`?\\}" , "${env:path}" , "it will return true or false instead" , "The function also prevents `Get-ItemProperty` from failing" , "`r`n" )