AMSI Bypass Followed by PowerShell Child-Process Outbound Connection (5-min Correlation)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects potential malicious activity involving PowerShell by correlating signs of an Antimalware Scan Interface (AMSI) bypass attempt with an subsequent network connection to an external, non-standard port. The rule monitors for common command-line patterns used to disable or impair AMSI functionality within PowerShell processes, followed by suspicious outbound network traffic from the same process within a five-minute window.