AMSI Bypass Pattern Assembly GetType

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects code fragments commonly found in small and obfuscated PowerShell scripts designed to bypass Antimalware Scan Interface (AMSI). The rule specifically looks for the combination of '[Ref].Assembly.GetType', 'SetValue($null,$true)', and 'NonPublic,Static' within PowerShell script block text, which are indicative of reflection-based AMSI bypass techniques.