Suspicious AMSI decode attempt

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Minute
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Deobfuscate/Decode Files or Information (T1140)
Severity	Informational

A script has executed commands that can be used to decode commands or files.

Avoid security mitigations and detections.

Check the payload for malicious activity.