Invoke-DOSfuscation

Why we included this project

Most blue teams only ever see a fraction of what cmd.exe will let an attacker get away with, and this framework exists to map the rest of that surface. It grew out of FIN7 slipping past traditional detection using an environment-variable substitution trick native to cmd.exe, which led to a PowerShell-based generator that turns ordinary commands into thousands of obfuscated variants. The bundled test harness is the part defenders will care about most: after generating samples it runs each one against your regex-based detection rules and flags the ones that get zero or minimal hits. It also ships 1,000 pre-built sample commands plus Sysmon and Security event log files so detection engineers can exercise their rule sets and close blind spots before attackers find them.