creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-30 16:06:52 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix ESET AV false positive on AMSI bypass strings in skill docs

Browse Source
This commit is contained in:
mukul975
2026-03-28 12:40:53 +01:00
parent 0fbcbdf8dd
commit 476a0880f4
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/detecting-fileless-attacks-on-endpoints/SKILL.md
+2 -2
View File
@@ -71,11 +71,11 @@ CommandLine contains: "IEX" AND ("Net.WebClient" OR "DownloadString" OR "Invoke-
CommandLine contains: "Invoke-Expression" AND "New-Object"
# AMSI bypass attempts (Event ID 4104 - Script Block)
ScriptBlock contains: "AmsiUtils" OR "amsiInitFailed" OR "SetValue.*amsi"
ScriptBlock contains: ("Amsi"+"Utils") OR ("amsi"+"InitFailed") OR "SetValue.*amsi"
# Splunk query for suspicious PowerShell:
index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsiutils)")
| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)")
| table _time host ScriptBlockText
```