AMSI JIT Heap Patch via RuntimeHelpers.PrepareMethod in PowerShell 7
This rule detects PowerShell script block execution containing indicators commonly associated with JIT heap memory manipulation and AMSI bypass techniques. It uses a scoring system based on the presence of specific .NET classes and methods used to allocate, copy, and change protection on memory pages, which are typical of fileless payload execution and security feature subversion.
Splunk (SPL)
