Potemkin Loader - AMSI Bypass via Memory Patching
This rule detects attempts by the PowerShell process to bypass the Antimalware Scan Interface (AMSI) by patching the amsi.dll in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events targeting 'powershell.exe' where 'amsi.dll' has been loaded into the process's memory space. This technique is often used by malware, such as Potemkin Loader, to evade detection.
Microsoft Sentinel (KQL)
