huntrule

Suspicious PowerShell AMSI or ETW Tampering

PremiumReviewedSigma · High · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-09-19
Updated
2026-09-19
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell script content that patches or disables the Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW), a defense-evasion technique used to blind in-memory scanning and telemetry before executing malicious payloads. Such tampering is a hallmark of offensive tooling that seeks to run undetected in memory.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Custom Cobalt Strike Command Execution
Malicious Windows Defender Real-Time Monitoring Disabled via PowerShell
Malicious AMSI Bypass via AmsiUtils amsiInitFailed Manipulation
Suspicious Batch Fake Installer Spawning PowerShell Downloader via OXLoader
Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise
Suspicious ClickFix PowerShell Execution with Hidden Window (via process_creation)
Suspicious Encoded PowerShell Execution with No Profile
Suspicious PowerShell Encoded Command Execution
Suspicious PowerShell BITS Transfer of DLL Payload via process_creation
Suspicious PowerShell AMSI or ETW Tampering
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.