Potential AMSI Bypass Using NULL Bits in Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects attempts to bypass Antimalware Scan Interface (AMSI) functionalities by using specific strings or NULL bits in command-line arguments. Adversaries often employ such techniques to obfuscate malicious scripts or commands, preventing security products from detecting and blocking them. The rule specifically looks for patterns like "if(0){{{0}}}' -f $(0 -as [char]) +" and "#<NULL>" in the command line, which are known indicators of AMSI bypass attempts.