Merge PR #4803 from @frack113 - Update regex based rules

update: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module - Remove unnecessary starting wildcard
update: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module - Remove unnecessary starting wildcard
update: Invoke-Obfuscation VAR+ Launcher - PowerShell Module - Remove unnecessary starting wildcard
update: Invoke-Obfuscation Via Stdin - PowerShell Module - Remove unnecessary starting wildcard
update: Invoke-Obfuscation Via Use Clip - PowerShell Module - Remove unnecessary starting wildcard
update: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module - Remove unnecessary starting wildcard
update: Invoke-Obfuscation CLIP+ Launcher - PowerShell - Remove unnecessary starting wildcard
update: Invoke-Obfuscation STDIN+ Launcher - Powershell - Remove unnecessary starting wildcard
update: Invoke-Obfuscation VAR+ Launcher - PowerShell - Remove unnecessary starting wildcard
update: Invoke-Obfuscation Via Stdin - Powershell - Remove unnecessary starting wildcard
update: Invoke-Obfuscation Via Use Clip - Powershell - Remove unnecessary starting wildcard
update: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell - Remove unnecessary starting wildcard
update: Invoke-Obfuscation STDIN+ Launcher - Update rule to use regex for better accuracy in CLI
update: Invoke-Obfuscation VAR+ Launcher - Update rule to use regex for better accuracy in CLI
update: Invoke-Obfuscation Via Stdin - Update rule to use regex for better accuracy in CLI
update: Invoke-Obfuscation Via Use Clip - Update rule to use regex for better accuracy in CLI 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
 author: Jonathan Cheong, oscd.community
 date: 2020/10/13
-modified: 2022/12/02
+modified: 2024/04/05
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,7 +18,7 @@ logsource:
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
-        ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"'
+        ScriptBlockText|re: 'cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"'
     condition: selection_4104
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 25)
 author: Jonathan Cheong, oscd.community
 date: 2020/10/15
-modified: 2022/12/03
+modified: 2024/04/05
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,7 +18,7 @@ logsource:
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
-        ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+"'
+        ScriptBlockText|re: 'cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+"'
     condition: selection_4104
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 24)
 author: Jonathan Cheong, oscd.community
 date: 2020/10/15
-modified: 2022/12/02
+modified: 2024/04/05
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,7 +18,7 @@ logsource:
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
-        ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*"'
+        ScriptBlockText|re: 'cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*"'
     condition: selection_4104
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009  # (Task28)
 author: Nikita Nazarov, oscd.community
 date: 2020/10/12
-modified: 2022/11/29
+modified: 2024/04/05
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,7 +18,7 @@ logsource:
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
-        ScriptBlockText|re: '(?i).*(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*"'
+        ScriptBlockText|re: '(?i)(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*"'
     condition: selection_4104
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009  # (Task29)
 author: Nikita Nazarov, oscd.community
 date: 2020/10/09
-modified: 2022/11/29
+modified: 2024/04/15
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,7 +18,7 @@ logsource:
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
-        ScriptBlockText|re: '(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*'
+        ScriptBlockText|re: '(?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)'
     condition: selection_4104
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009 # (Task27)
 author: Timur Zinniatullin, oscd.community
 date: 2020/10/13
-modified: 2022/12/02
+modified: 2024/04/05
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,7 +18,7 @@ logsource:
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
-        ScriptBlockText|re: '(?i).*&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c' # FPs with |\/r
+        ScriptBlockText|re: '(?i)&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c' # FPs with |\/r
     condition: selection_4104
 falsepositives:
     - Unknown