Query: detect Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning in logs
Matching passage: Sigma rule: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning. Logsource: windows / process_creation. Rule: title: Potential AMSI Bypass Via .NET Reflection id: 30edb182-aa75-42c0-b0a9-e998bb29067c related: - id: 4f927692-68b5-4267-871b-073c45f4f6fe type: obsolete status: test description: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning references: - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/ - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ author: Markus Neis, @Kostastsale date: 2018-08-17 modified: 2023-02-03 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains|all: - System.Management.Automation.AmsiUtils - amsiInitFailed - CommandLine|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the exe. Logsource: windows / process_creation. Rule: title: Potential Binary Impersonating Sysinternals Tools id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9 status: test description: 'Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2025-04-12 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_exe: Image|endswith: - \accesschk.exe - \accesschk64.exe - \AccessEnum.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADInsight.exe - \ADInsight64.exe - \adrestore.exe - \adrestore64.exe - \Autologon.exe - \Autologon64.exe - \Autoruns.exe - \Autoruns64.exe - \autorunsc.exe - \autorunsc64.exe - \Bginfo.exe - \Bginfo64.exe - \Cacheset.exe - \Cacheset64.exe - \Clockres.exe - \Clockres64.exe - \Contig.exe - \Contig64.exe - \Coreinfo.exe - \Coreinfo64.exe - \CPUSTRES.EXE - \CPUSTRES64.EXE - \ctrl2cap.exe - \Dbgview.exe - \dbgview64.exe - \Desktops.exe - \Desktops64.exe - \disk2vhd.exe - \disk2vhd64.exe - \diskext.exe - \diskext64.exe - \Diskmon.exe - \Diskmon64.exe - \DiskView.exe - \DiskView64.exe - \du.exe - \du64.exe - \efsdump.exe - \FindLinks.exe - \FindLinks64.exe - \handle.exe - \handle64.exe - \hex2dec.exe - \hex2dec64.exe - \junction.exe - \junction64.exe - \ldmdump.exe - \listdlls.exe - \listdlls64.exe - \livekd.exe - \livekd64.exe - \loadOrd.exe - \loadOrd64.exe - \loadOrdC.exe - \loadOrdC64.exe - \logonsessions.exe - \logonsessions64.exe - \movefile.exe - \movefile64.exe - \notmyfault.exe - \notmyfault64.exe - \notmyfaultc.exe - \notmyfaultc64.exe - \ntfsinfo.exe - \ntfsinfo64.exe - \pendmoves.exe - \pendmoves64.exe - \pipelist.exe - \pipelist64.exe - \portmon.exe - \procdump.exe - \procdump64.exe - \procexp.exe - \procexp64.exe - \Procmon.exe - \Procmon64.exe - \psExec.exe - \psExec64.exe - \psfile.exe - \psfile64.exe - \psGetsid.exe - \psGetsid64.exe - \psInfo.exe - \psInfo64.exe - \pskill.exe - \pskill64.exe - \pslist.exe - \pslist64.exe - \psLoggedon.exe - \psLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \pspasswd.exe - \pspasswd64.exe - \psping.exe - \psping64.exe - \psService.exe - \p