Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1027.010

Command Obfuscation

Stealth 37 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Suspicious Windows Powershell Arguments production 2026-10-19
elastic Potential PowerShell Obfuscated Script via High Entropy production 2026-10-19
elastic Potential Hex Payload Execution via Command-Line production 2026-10-09
sigma PowerShell Dynamic Module Invocation Via ExportedCommands Array Index experimental 2026-10-06
elastic PowerShell Obfuscation via Negative Index String Reversal production 2026-10-05
elastic Suspicious PowerShell from npm Package Install production 2026-09-22
elastic Command Obfuscation via Unicode Modifier Letters production 2026-09-18
elastic Potential Antimalware Scan Interface Bypass via PowerShell production 2026-09-18
elastic Potential PowerShell Obfuscation via Invalid Escape Sequences production 2026-09-18
elastic Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion production 2026-09-18
elastic Potential PowerShell Obfuscation via Character Array Reconstruction production 2026-09-18
elastic Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation production 2026-09-18
elastic Potential PowerShell Obfuscation via High Numeric Character Proportion production 2026-09-18
elastic Potential Dynamic IEX Reconstruction via Environment Variables production 2026-09-18
elastic Dynamic IEX Reconstruction via Method String Access production 2026-09-18
elastic Potential PowerShell Obfuscation via Reverse Keywords production 2026-09-18
elastic Potential PowerShell Obfuscation via String Concatenation production 2026-09-18
elastic Potential PowerShell Obfuscation via String Reordering production 2026-09-18
elastic Potential PowerShell Obfuscation via Special Character Overuse production 2026-09-18
elastic Suspicious Execution with NodeJS production 2026-09-18
elastic Command Line Obfuscation via Whitespace Padding production 2026-09-18
elastic Decoded Payload Piped to Interpreter Detected via Defend for Containers production 2026-09-18
elastic Multi-Base64 Decoding Attempt from Suspicious Location production 2026-09-18
elastic Suspicious Powershell Script production 2026-09-18
elastic Deprecated - Potential PowerShell Obfuscated Script deprecated 2026-08-19
splunk Windows Command Obfuscation with Environment Variable Substrings production 2026-05-13
splunk Windows PowerShell Process Implementing Manual Base64 Decoder production 2026-05-13
sigma Python One-Liners with Base64 Decoding - Linux experimental 2026-03-09
sigma Python One-Liners with Base64 Decoding experimental 2026-03-09
sigma Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix experimental 2025-11-26
sigma Suspicious Usage of For Loop with Recursive Directory Search in CMD experimental 2025-11-12
sigma Suspicious Space Characters in RunMRU Registry Path - ClickFix experimental 2025-11-04
sigma Suspicious Space Characters in TypedPaths Registry Path - FileFix experimental 2025-11-04
sigma Obfuscated PowerShell MSI Install via WindowsInstaller COM experimental 2025-05-27
sigma Potential Obfuscated Ordinal Call Via Rundll32 test 2025-02-23
sigma Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace test 2023-12-01
sigma Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace test 2023-12-01