AMSI Bypass Pattern Assembly GetType

 1title: AMSI Bypass Pattern Assembly GetType
 2id: e0d6c087-2d1c-47fd-8799-3904103c5a98
 3status: test
 4description: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
 5references:
 6    - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
 7    - https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA
 8author: Florian Roth (Nextron Systems)
 9date: 2022-11-09
10tags:
11    - attack.defense-evasion
12    - attack.t1562.001
13    - attack.execution
14logsource:
15    product: windows
16    category: ps_script
17    definition: 'Requirements: Script Block Logging must be enabled'
18detection:
19    selection:
20        ScriptBlockText|contains|all:
21            - '[Ref].Assembly.GetType'
22            - 'SetValue($null,$true)'
23            - 'NonPublic,Static'
24    condition: selection
25falsepositives:
26    - Unknown
27level: high

References

• Exploring PowerShell AMSI and Logging Evasion - MDSec

  By now, many of us know that during an engagement, AMSI (Antimalware Scripting Interface) can be used to trip up PowerShell scripts in an operators arsenal. Attempt to IEX Invoke-Mimikatz...

  
  Read More

• x.com

  
  Read More

Related rules

• HackTool - CobaltStrike BOF Injection Pattern
• HackTool - Stracciatella Execution
• Service StartupType Change Via PowerShell Set-Service
• Service StartupType Change Via Sc.EXE
• APT29 2018 Phishing Campaign CommandLine Indicators