Invoke-PowerShellTcp Reverse Shell Execution Following AMSI Bypass
Detects the execution of PowerShell commands that exhibit characteristics of reverse shells, such as the use of Nishang or Invoke-PowerShellTcp scripts, or the combination of web-download commands with expression evaluation. The rule also calculates a risk score based on the presence of common AMSI bypass flags (e.g., hidden windows, execution policy overrides) and specific reverse shell indicators.
Splunk (SPL)
