Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects PowerShell scripts attempting to tamper with or bypass the Antimalware Scan Interface (AMSI) by reflecting on the 'AmsiUtils' class within the 'System.Management.Automation' assembly. This activity is a common technique used by adversaries to execute malicious scripts without security product intervention.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects sophisticated AMSI bypass attempts in PowerShell sessions. The rule monitors for a combination of techniques, including patching the 'InternalNotify' function in the AMSI vtable using 'VirtualProtect', and leveraging 'Marshal.WriteInt64' to nullify critical security scan paths ('WinScanContent' and 'WinReportContent') in memory.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by manipulating memory structures or using reflection to nullify security checks. The rule looks for signatures of commonly used bypass techniques, such as using Marshal to overwrite amsiContext, calling GetDelegateForFunctionPointer with null/IntPtr.Zero arguments to target AmsiInitialize/AmsiScanBuffer, or declaring unusual DllImport signatures for amsi.dll functions within PowerShell script blocks.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 5.1 by using .NET reflection to manipulate the 'amsiInitFailed' field within the 'AmsiUtils' class. The rule monitors both script block logs and command-line arguments for patterns involving reflective field access, string concatenation of sensitive keywords, and reflection binding flags.
Detects attempts to patch AMSI (Antimalware Scan Interface) managed methods in PowerShell memory using JIT (Just-In-Time) compilation and memory write operations. The rule identifies suspicious combinations of terms related to method preparation, memory manipulation (via System.Runtime.InteropServices.Marshal), and direct references to AMSI components within PowerShell Script Block logs (Event ID 4104).
Detects attempts to bypass the Anti-Malware Scan Interface (AMSI) by identifying malicious memory modifications or reflective script patterns commonly used to patch AMSI in memory. This rule correlates process-level memory events (VirtualProtect) with PowerShell ScriptBlock logging (Event ID 4104) to identify tampering with amsi.dll or AmsiScanBuffer.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 (pwsh.exe) by utilizing System.Reflection.Emit to dynamically emit Intermediate Language (IL) code. This technique involves JIT heap patching where an attacker constructs a dynamic method to intercept or nullify AMSI scan functions (e.g., AmsiScanBuffer) within the runtime memory of the PowerShell process.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
Detects attempts to tamper with security monitoring mechanisms including AMSI, ETW, and PowerShell Script Block Logging by monitoring process command line arguments for termination or configuration modifications and tracking registry key modifications related to these security features.
Detects potential cross-process memory injection activity by monitoring for a non-debugger process that performs both NtAllocateVirtualMemory and WriteProcessMemory operations against a sensitive GUI target process within a short 5-minute correlation window.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by performing in-memory patching of the AmsiScanBuffer function within amsi.dll. The rule identifies suspicious memory manipulation operations (VirtualProtect, WriteProcessMemory) performed by script hosts (PowerShell, WScript, CScript) involving PAGE_EXECUTE_READWRITE permissions or specific memory modification patterns (0xB8 opcode patching) indicative of disabling security scanning capabilities.
Detects the use of .NET reflection within PowerShell scripts to manipulate the 'amsiInitFailed' field in 'System.Management.Automation.AmsiUtils'. This technique is a common method to disable the Antimalware Scan Interface (AMSI) for the current process session. The rule monitors PowerShell script block logs for the co-occurrence of AMSI-related classes/fields and specific reflection primitives.
Detects specific PowerShell Script Block Logging (Event ID 4104) patterns associated with Anti-Malware Scan Interface (AMSI) bypass techniques. The rule flags suspicious script content involving DynamicMethod IL emission, Marshal.WriteInt64 memory modification, or reflection-based manipulation of AmsiUtils fields, which are common indicators of attempts to disable or impair security inspection mechanisms in PowerShell environments.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
Hunts for the Python process utilizing ctypes bindings to dynamically resolve VirtualProtect and patch the AmsiScanBuffer. This rule specifically looks for 'WriteProcessMemoryApiCall' events where the initiating process is 'python.exe' and the target memory address is within the 'amsi.dll' module.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
Page 47 of 52