Glove Stealer AMSI Patch: amsi.dll Load by PyInstaller Process from _MEI Temp Dir
Detects the loading of amsi.dll by processes frequently associated with PyInstaller or potential AMSI patching attempts. This rule monitors EventCode 7 (ImageLoad) events specifically identifying instances where amsi.dll is loaded by processes containing '_mei' (a common temporary directory prefix for PyInstaller), python executables running from temporary directories, or processes named 'winupdate.exe'. Such activity is often observed during the execution of obfuscated or packaged malicious binaries attempting to disable or bypass AMSI (Antimalware Scan Interface).
Splunk (SPL)
