Bind Link Abuse Redirecting amsi.dll via bindutil.exe
Detects the use of the bindutil.exe utility with the --link argument to redirect or interact with amsi.dll. This behavior is indicative of an attempt to bypass or interfere with the Antimalware Scan Interface (AMSI) in Windows, potentially allowing for the execution of malicious scripts or code without detection. The rule includes filters for legitimate processes typically associated with virtualized or containerized environments.
Sigma
