danielbohannon/Invoke-Obfuscation
Invoke Obfuscation
Invoke-Obfuscation is a PowerShell-based tool for transforming PowerShell commands and scripts into obfuscated forms to evade signature-based detection. It applies token-level, string-level, and encoding techniques to hide execution logic, and supports compressing commands before obfuscation to reduce size while concealing the original code.
The tool distinguishes itself through layered obfuscation that can be applied and reversed one layer at a time, allowing users to restore a script's original form. It offers multiple encoding schemes including ASCII, hex, octal, binary, and XOR, and can hide command-line arguments from powershell.exe by pushing them to parent or grandparent processes. Invoke-Obfuscation also generates obfuscated launcher commands for execution on target systems and simulates obfuscation across PowerShell versions 2.0 through 5.0 to test security tool detection capabilities.
The tool provides both an interactive interface for navigating obfuscation layers and a command-line mode for direct obfuscation operations. It supports launching obfuscated scripts through various methods including CLIP, WMIC, and stdin with randomized execution flags, and includes regex-based and auto-detection menu navigation to avoid manual backtracking.
Features
- PowerShell Obfuscation Tools - Transforms PowerShell commands and scripts into obfuscated forms to evade signature-based detection.
- Language-Specific Command Obfuscation - Runs obfuscation operations directly from the command line using compact syntax without interactive mode.
- Obfuscation Encodings - Encodes PowerShell scripts using ASCII, hex, octal, binary, and XOR to bypass security filters.
- Layer Reversal Tools - Allows reversing obfuscation one layer at a time to restore a script's original form.
- Process Argument Hiding - Hides command-line arguments by pushing them to parent or grandparent processes to evade logging.
- Obfuscated Script Launchers - Provides multiple methods to launch obfuscated scripts with randomized flags for evasion.
- Compressed Command Obfuscation - Compresses PowerShell commands before obfuscation to reduce size and conceal logic.
- Obfuscated Launch Command Generators - Generates obfuscated PowerShell launcher commands for executing hidden scripts on target systems.
- Whitespace and Special Character Insertions - Obfuscates scripts by inserting whitespace or special characters to alter appearance without changing functionality.
- Obfuscation - Obfuscator for PowerShell.
- Sécurité et confidentialité - Obfuscates code to evade detection.
