Windows Defender AMSI Trigger Detected

Title: Windows Defender AMSI Trigger Detected
Status: stable
Description:Detects triggering of AMSI by Windows Defender.
References:
  -https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
Author: Bhabesh Raj
Date: 2020-09-14
modified:2022-12-07
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• product: windows
• service: windefend

Detection:
  selection:
    EventID: '1116'
    SourceName: 'AMSI'
  condition:selection
Falsepositives:
  -Unlikely
Level: high