valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

removing for new pull request

Browse Source
This commit is contained in:
yt0ng 2018-08-17 18:42:10 +02:00 committed by GitHub
parent 5bb6f566ba
commit ca7e8d6468
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
rules/windows/sysmon/sysmon_powershell_AMSI_bypass.yml
View File

@ -1,24 +0,0 @@
title: Powershell AMSI Bypass via .NET Reflection
status: experimental
description: Detects Request to amsiInitFailed that can be used to disable AMSI Scanning
references:
- https://twitter.com/mattifestation/status/735261176745988096
- https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120
author: Markus Neis
date: 2018/08/17
logsource:
product: windows
service: sysmon
detection:
selection1:
EventID: 1
CommandLine:
- '*System.Management.Automation.AmsiUtils*'
selection2:
CommandLine:
- '*amsiInitFailed*'
condition: selection1 and selection2
falsepositives:
- Potential Admin Activity
level: high