Invoke-PowerShellTcp Nishang Reverse Shell Execution via IEX After AMSI Bypass
Detects the execution of the Nishang 'Invoke-PowerShellTcp' reverse shell payload via PowerShell. This rule monitors for common obfuscated patterns involving IEX (Invoke-Expression) and 'DownloadString' commonly used to download and execute scripts directly into memory, often following an AMSI bypass attempt.
Microsoft Sentinel (KQL)
