From 8ae54e8e1e130eaa7edae1b9bfd3d912e88a3e19 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 25 Jun 2021 15:54:57 -0400 Subject: [PATCH] this was brough up by doc team, it was causing docs to not be updated --- detections/endpoint/unloading_amsi_via_reflection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index 8d8b5c8bd5..f4c8e8ccda 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -13,7 +13,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct - COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` + COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It