ChocoShell AMSI bypass co-occurring with WinHTTP COM or timing evasion
This rule detects PowerShell processes attempting to bypass the Antimalware Scan Interface (AMSI) via .NET reflection, specifically targeting 'AmsiUtils' or 'amsiInitFailed' fields. To reduce noise, it correlates this activity with the presence of WinHTTP COM objects (for network evasion) or timing-based functions (e.g., Stopwatch, GetTickCount) often used for anti-sandbox or anti-analysis evasion, characterizing behavior consistent with the ChocoShell malware family.
Microsoft Sentinel (KQL)
