Potential AMSI Bypass Script Using NULL Bits

Title: Potential AMSI Bypass Script Using NULL Bits
Status: test
Description:Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
References:
  -https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-04
modified:2023-05-09
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'if(0){{{0}}}' -f $(0 -as [char]) +'
      -'#<NULL>'

  condition:selection
Falsepositives:
  -Unknown
Level: medium