Invoke-PowerShellTcp After AMSI Bypass: Compound Detection on Same Host (T1059.001)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects potential malicious activity where a PowerShell process first attempts to bypass the Antimalware Scan Interface (AMSI) and subsequently executes code characteristic of a reverse shell or network-based command execution within a 10-minute window. This sequence is a common pattern for fileless malware or remote access trojans (RATs) attempting to evade detection and maintain persistence.