Merge pull request #1113 from NikitaStormwind/regular29(2)

[OSCD] Detects Obfuscated Powershell via use Clip.exe in Scripts #29 (process_creation)

rules/windows/process_creation/win_invoke_obfuscation_via_use_clip.yml

@@ -0,0 +1,23 @@
+title: Invoke-Obfuscation Via Use Clip
+id: e1561947-b4e3-4a74-9bdd-83baed21bdb5
+description: Detects Obfuscated Powershell via use Clip.exe in Scripts
+status: experimental
+author: Nikita Nazarov, oscd.community
+date: 2020/10/09
+references:
+    - https://github.com/Neo23x0/sigma/issues/1009 #(Task29)
+tags:
+    - attack.defense_evasion
+    - attack.t1027
+    - attack.execution
+    - attack.t1059.001
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        - CommandLine|re: '(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high