admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-06-28 16:09:42 +00:00
committed by GitHub
parent 85f267f3ed c5919dee1f
commit 62b9fa10e6
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/unloading_amsi_via_reflection.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
This analytic identifies the behavior of AMSI being tampered with. Implemented natively
in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct
COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")`
COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")`
taken from Powershell-Empire. \
During triage, review parallel processes using an EDR product or 4688 events. It