Microsoft Windows AMSI (v1.0.7)
The Windows Antimalware Scan Interface (AMSI) is a security feature in Windows OSs that allows services to scan for files, memory and other data for threats.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Analytics & SIEM
Modeling rules (1)
- Microsoft Windows AMSI Security Modeling Rule
Parsing rules (1)
- Microsoft Windows AMSI Parsing Rule
README
Microsoft Windows AMSI
This pack includes Cortex XSIAM content.
<~XSIAM>
This pack requires an XDR Agent to be installed on the relevant endpoints.