Unloading AMSI via PowerShell Reflection

The analytic detects attempts to tamper with AMSI (Antimalware Scan Interface) using PowerShell reflection. It specifically looks for PowerShell Script Block Logging (EventCode=4104) entries that contain `system.management.automation.amsi`. This activity is a strong indicator of an adversary trying to bypass AMSI, a critical security feature designed to detect and block malicious scripts. A successful bypass could allow malicious code to execute undetected, potentially leading to system compromise and data exfiltration.