SEKOIA.IO Rules high stable sigma

Powershell AMSI Bypass

This rule aims to detect attempts to bypass AMSI in PowerShell using specific techniques.

View Source

Detection Logic

selection:
  - action.properties.ScriptBlockText
| contains: NonPublic,Static
  - process.command_line
| contains: NonPublic,Static
filter:
  process.name: wsmprovhost.exe
condition: selection and not filter

Field Validations

Loading…

Comments (0)

Loading comments...