RightToLeft Obfuscation - PowerShell

[FilipPwn]

Summary of the Pull Request

Added a new detection rule for identifying PowerShell scripts that use RightToLeft obfuscation techniques to evade detection.

Changelog

new: RightToLeft Obfuscation - PowerShell - Detects obfuscated PowerShell scripts using RightToLeft method for evasion.

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @FilipPwn 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[nasbench]

Hey @FilipPwn and thanks for the contribution. In order for this to be a detection you need to add a bit more context. As simply specifying the string "RightToLeft" isn't enough. You're only hunting for potentially interesting scripts. Hence either add additional context with more strings or move this to the threat hunting folder.

Also your description is lacking a lot of the context. This technique is relying on the regex option of the "Matches" method. So please include that in both the description and enhance the title to reflect that as this isn't detecting a generic RTLO technique but rather a specific powershell implementation of it.