Did You Spot "Invoke-Expression"?, (Thu, Nov 5th)

When a PowerShell script is obfuscated, the deobfuscation process is, most of the time, performed through the Invoke-Expression cmdlet[1]. Invoke-Expression evaluates the string passed as an argument and returns the results of the commands inside the string. Example:

Article Link: https://isc.sans.edu/diary/rss/26762