Potential AMSI Bypass Script Using NULL Bits

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the use of specific strings or NULL bits within PowerShell scripts that are commonly employed to bypass Antimalware Scan Interface (AMSI) functionalities. This technique aims to prevent security products from inspecting malicious script content.