Potential Antimalware Scan Interface Bypass via PowerShell

Elastic Stack Serverless Security

Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection.

Rule type: query

Rule indices:

winlogbeat-*
logs-windows.*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#date-math[Date Math format], see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell

Tags:

Elastic
Host
Windows
Threat Detection
Defense Evasion
PowerShell

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Rule query

		event.category :"process" and
 (
  powershell.file.script_block_text :
        (System.Management.Automation.AmsiUtils or
				 amsiInitFailed or
				 Invoke-AmsiBypass or
				 Bypass.AMSI or
				 amsi.dll or
				 AntimalwareProvider  or
				 amsiSession or
				 amsiContext or
				 System.Management.Automation.ScriptBlock or
				 AmsiInitialize or
				 unloadobfuscated or
				 unloadsilent or
				 AmsiX64 or
				 AmsiX32 or
				 FindAmsiFun) or

  powershell.file.script_block_text : ("[System.Runtime.InteropServices.Marshal]::Copy" and "VirtualProtect") or

  powershell.file.script_block_text : ("[Ref].Assembly.GetType(('System.Management.Automation" and ".SetValue(")
 )

	

Framework: MITRE ATT&CKTM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Command and Scripting Interpreter
- ID: T1059
- Reference URL: https://attack.mitre.org/techniques/T1059/
Sub-technique:
- Name: PowerShell
- ID: T1059.001
- Reference URL: https://attack.mitre.org/techniques/T1059/001/