SEKOIA.IO Rules medium stable sigma

PowerShell AMSI Deactivation Bypass Using .NET Reflection

Detects Request to amsiInitFailed that can be used to disable AMSI (Antimalware Scan Interface) Scanning. More information about Antimalware Scan Interface https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal.

View Source

Detection Logic

selection:
  - process.command_line
| contains: amsiinitfailed
  - action.properties.ScriptBlockText
| contains: amsiinitfailed
selection_base64encoded:
  - process.command_line
| wide
| base64offset
| contains: amsiInitFailed
  - action.properties.ScriptBlockText
| wide
| base64offset
| contains: amsiInitFailed
condition: selection or selection_base64encoded

Field Validations

Loading…

Comments (0)

Loading comments...