corpus.blog
41,554 blogs · 5,149,205 posts Claim your blog
Record · corpus.blog/posts/01a08c62-6815-7057-a186-fa1577d3d98b

Bypassing Detections with Command-Line Obfuscation

Wietze Beukema · published 24 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at wietzebeukema.nl Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
30
Words captured
3,070

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://doi.org/10.5815/ijcnis.2017.07.01
doi.org
https://lolbas-project.github.io/
lolbas-project.github.io
https://www.crowdstrike.com/en-us/global-threat-report/
crowdstrike.com
https://github.com/SigmaHQ/sigma/blob/598d29f811c1859ba18e05b8c419cc94410c9a55/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml
github.com
https://x.com/cyb3rops/status/1029818856557215744
x.com
https://attack.mitre.org/techniques/T1027/010/
attack.mitre.org
https://services.google.com/fh/files/misc/exploring-the-depths-of-cmd-exe-obfuscation-wp-en.pdf
services.google.com
https://github.com/danielbohannon/Invoke-Obfuscation
github.com
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
learn.microsoft.com
https://github.com/SigmaHQ/sigma/blob/3ce034bb201fda14a391f1ad9111340b8dbea428/deprecated/windows/proc_creation_win_credential_acquisition_registry_hive_dumping.yml
github.com
https://github.com/elastic/detection-rules/blob/c0f12ddecfb02ecf36e0efff14d2cd21e823fa61/rules/windows/credential_access_dump_registry_hives.toml
github.com
https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
github.com
https://github.com/reprise99/Sentinel-Queries/blob/3102a56d0f081441a0b73c906ceed227fa93701b/Defender%20for%20Endpoint/Device-DetectEncodedPowershellandDecode.kql
github.com
https://github.com/SigmaHQ/sigma/blob/3ce034bb201fda14a391f1ad9111340b8dbea428/rules-emerging-threats/2019/Malware/QBot/proc_creation_win_malware_qbot.yml
github.com
https://github.com/SigmaHQ/sigma/blob/598d29f811c1859ba18e05b8c419cc94410c9a55/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml
github.com
https://github.com/splunk/security_content/blob/76a9a02c9e7826721e8867d5838c84a7768d068c/detections/endpoint/windows_msiexec_remote_download.yml
github.com
https://github.com/splunk/security_content/blob/fdaa038eab70c41517d8e8290c4f522154b7e238/detections/endpoint/linux_curl_upload_file.yml
github.com
https://github.com/elastic/detection-rules/blob/059d7efa25adab2f2c43b87efca9bfaad887aaa7/rules/linux/command_and_control_ip_forwarding_activity.toml
github.com
https://github.com/splunk/security_content/blob/fdaa038eab70c41517d8e8290c4f522154b7e238/detections/endpoint/wget_download_and_bash_execution.yml
github.com
https://github.com/SigmaHQ/sigma/blob/598d29f811c1859ba18e05b8c419cc94410c9a55/rules/macos/process_creation/proc_creation_macos_applescript.yml
github.com
https://github.com/SigmaHQ/sigma/blob/78a78c79ffd2998cd864618c538395a4e8c23902/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_tar_files_direct_ip.yml
github.com
WorstFit: Unveiling Hidden Transformers in Windows ANSI! Read at the source ↗
blog.orange.tw
https://www.atomicredteam.io/
atomicredteam.io
https://github.com/wietze/windows-command-line-obfuscation
github.com
https://github.com/wietze/Invoke-ArgFuscator
github.com
https://argfuscator.net
argfuscator.net
https://github.com/wietze/ArgFuscator.net/
github.com
https://www.linkedin.com/posts/0x534c_cybersecurity-argfuscator-kqlobfusguard-activity-7296880904411521024-bWAK
linkedin.com
https://twitter.com/mthcht/status/1888605609194295307
twitter.com
https://learn.microsoft.com/en-us/kusto/query/parse-command-line-function
learn.microsoft.com
Elsewhere on wietzebeukema.nl (6)