valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Powershell AMSI Bypass via .NET Reflection

Browse Source 
[Ref].Assembly.GetType('http://System.Management .Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

seen in recent activity https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120
This commit is contained in:
yt0ng 2018-08-17 18:26:04 +02:00 committed by GitHub
parent 07e411fe6b
commit 8ecf167e85
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
rules/windows/sysmon/sysmon_powershell_AMSI_bypass.yml Normal file
View File

@ -0,0 +1,24 @@
title: Powershell AMSI Bypass via .NET Reflection
status: experimental
description: Detects Request to amsiInitFailed that can be used to disable AMSI Scanning
references:
- https://twitter.com/mattifestation/status/735261176745988096
- https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120
author: Markus Neis
date: 2018/08/17
logsource:
product: windows
service: sysmon
detection:
selection1:
EventID: 1
CommandLine:
- '*System.Management.Automation.AmsiUtils*'
selection2:
CommandLine:
- '*amsiInitFailed*'
condition: selection1 and selection2
falsepositives:
- Potential Admin Activity
level: high