Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by using .NET reflection techniques. The detection monitors for common class and method names (e.g., 'AmsiUtils', 'Marshal.WriteInt64') utilized by attackers to disable or tamper with AMSI's memory structures within a running PowerShell process.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) using .NET reflection techniques. It specifically looks for patterns involving the manipulation of internal AMSI fields, such as 'AmsiUtils', 's_amsiInitFailed', and 'DynamicMethod', which are common indicators of malicious attempts to disable or evade script content analysis in memory.
Detects the execution of PowerShell processes where command lines contain references to Nishang framework scripts, 'Invoke-PowerShellTcp' reverse shell patterns, or indicators of attempts to bypass the Antimalware Scan Interface (AMSI) such as 'AmsiScanBuffer' or 'amsiInitFailed'.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, obfuscated method calls, and manipulation of internal AMSI/ETW structures (e.g., AmsiScanBuffer, AmsiUtils, Marshal.WriteInt64) within PowerShell Script Block logs (Event ID 4104).
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common reflection-based patterns, such as accessing 'AmsiUtils', modifying 'amsiInitFailed' flags, or using 'BindingFlags' to manipulate non-public members. These techniques are commonly used to disable AMSI scanning within a malicious PowerShell script's memory space.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) by dynamically generating and emitting malicious Intermediate Language (IL) code at runtime. It monitors Event ID 4104 for specific patterns, such as the use of 'System.Reflection.Emit', 'AmsiUtils', or 's_amsiInitFailed', which are indicative of techniques designed to manipulate in-memory structures to disable AMSI protections.
This rule detects PowerShell script block execution that attempts to bypass the Antimalware Scan Interface (AMSI) by targeting memory structures. It identifies scripts invoking methods like VirtualProtect, NtProtectVirtualMemory, or WriteProcessMemory in conjunction with AMSI-related functions or DLL references, often indicating an attempt to disable or patch AMSI to execute malicious payloads without detection.
This rule detects PowerShell script block execution containing indicators commonly associated with JIT heap memory manipulation and AMSI bypass techniques. It uses a scoring system based on the presence of specific .NET classes and methods used to allocate, copy, and change protection on memory pages, which are typical of fileless payload execution and security feature subversion.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. These techniques typically involve memory manipulation (e.g., using Marshal.WriteInt64) to overwrite AMSI structures within the PowerShell process, effectively rendering AMSI ineffective for script content scanning.
Detects PowerShell scripts attempting to tamper with or bypass the Antimalware Scan Interface (AMSI) by reflecting on the 'AmsiUtils' class within the 'System.Management.Automation' assembly. This activity is a common technique used by adversaries to execute malicious scripts without security product intervention.
Detects the use of System.Reflection.Emit.DynamicMethod in PowerShell to dynamically compile and execute Intermediate Language (IL) code. This technique is commonly used to patch AMSI internals, specifically by modifying 's_amsiInitFailed' to bypass scanning capabilities.
Detects sophisticated AMSI bypass attempts in PowerShell sessions. The rule monitors for a combination of techniques, including patching the 'InternalNotify' function in the AMSI vtable using 'VirtualProtect', and leveraging 'Marshal.WriteInt64' to nullify critical security scan paths ('WinScanContent' and 'WinReportContent') in memory.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by manipulating memory structures or using reflection to nullify security checks. The rule looks for signatures of commonly used bypass techniques, such as using Marshal to overwrite amsiContext, calling GetDelegateForFunctionPointer with null/IntPtr.Zero arguments to target AmsiInitialize/AmsiScanBuffer, or declaring unusual DllImport signatures for amsi.dll functions within PowerShell script blocks.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 5.1 by using .NET reflection to manipulate the 'amsiInitFailed' field within the 'AmsiUtils' class. The rule monitors both script block logs and command-line arguments for patterns involving reflective field access, string concatenation of sensitive keywords, and reflection binding flags.
Detects attempts to patch AMSI (Antimalware Scan Interface) managed methods in PowerShell memory using JIT (Just-In-Time) compilation and memory write operations. The rule identifies suspicious combinations of terms related to method preparation, memory manipulation (via System.Runtime.InteropServices.Marshal), and direct references to AMSI components within PowerShell Script Block logs (Event ID 4104).
Detects attempts to bypass the Anti-Malware Scan Interface (AMSI) by identifying malicious memory modifications or reflective script patterns commonly used to patch AMSI in memory. This rule correlates process-level memory events (VirtualProtect) with PowerShell ScriptBlock logging (Event ID 4104) to identify tampering with amsi.dll or AmsiScanBuffer.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 (pwsh.exe) by utilizing System.Reflection.Emit to dynamically emit Intermediate Language (IL) code. This technique involves JIT heap patching where an attacker constructs a dynamic method to intercept or nullify AMSI scan functions (e.g., AmsiScanBuffer) within the runtime memory of the PowerShell process.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) following the reconnaissance of security software or AMSI providers. It correlates WMI or registry-based discovery activities concerning security products or AMSI configurations with subsequent PowerShell-based AMSI bypass indicators (such as specific strings or method names indicative of memory patching) occurring on the same host within a 10-minute window.
This rule detects common PowerShell command-line arguments and patterns used by attackers to bypass or disable Antimalware Scan Interface (AMSI) in memory. Attackers often attempt to modify non-public, static members of the AmsiUtils class to force AMSI initialization failure, allowing for the execution of malicious scripts without detection.
This rule detects PowerShell execution attempts that include strings associated with Anti-Malware Scan Interface (AMSI) bypass techniques. Specifically, it searches for command-line arguments that attempt to manipulate memory (VirtualProtect, Marshal.WriteByte, RtlMoveMemory) or interact with AMSI/PowerShell internals (AmsiScanBuffer, amsi.dll) commonly used to disable AMSI scanning within a running process.
Page 19 of 60