Elastic high stable kql

Potential Antimalware Scan Interface Bypass via PowerShell

Detects PowerShell scripts that reference Antimalware Scan Interface (AMSI) bypass classes, methods, or known bypass strings. Attackers attempt AMSI bypass to disable scanning and run malicious PowerShell content undetected.

View Source

Detection Logic

event.category:"process" and host.os.type:windows and
  (
    powershell.file.script_block_text : (
      "System.Management.Automation.AmsiUtils" or
      amsiInitFailed or
      "Invoke-AmsiBypass" or
      "Bypass.AMSI" or
      "amsi.dll" or
      AntimalwareProvider or
      amsiSession or
      amsiContext or
      AmsiInitialize or
      unloadobfuscated or
      unloadsilent or
      AmsiX64 or
      AmsiX32 or
      FindAmsiFun or
      "AllocHGlobal((9076" or
      "[cHAr](65)+[cHaR]([byTe]0x6d)+[ChaR]([ByTe]0x73)+[CHaR]([BYte]0x69"
    ) or
    powershell.file.script_block_text:("[Ref].Assembly.GetType(('System.Management.Automation" and ".SetValue(") or
    powershell.file.script_block_text:("::AllocHGlobal((" and ".SetValue(" and "-replace" and ".NoRMALiZe(")
  ) and
  not powershell.file.script_block_text : (
    "sentinelbreakpoints" and "Set-PSBreakpoint"
  )

Field Validations

Loading…

Comments (0)

Loading comments...