Invoke-PowerShellTcp Nishang Reverse Shell Execution After AMSI Bypass
Detects the execution of PowerShell processes where command lines contain references to Nishang framework scripts, 'Invoke-PowerShellTcp' reverse shell patterns, or indicators of attempts to bypass the Antimalware Scan Interface (AMSI) such as 'AmsiScanBuffer' or 'amsiInitFailed'.
Cortex XDR
