PowerShell Obfuscation (Non English Chars)

Ethan Anderson@ethan

•updated Jul 17, 2025•2•3•40

This rule detects PowerShell command lines that contain non-English (Unicode) characters, excluding the en-dash character. This behavior is often indicative of obfuscation techniques used by adversaries to evade detection, as legitimate PowerShell commands typically do not contain such characters in their command line arguments.