Potential AMSI Bypass Via .NET Reflection

SigmaHQ Detections@sigmaHQ

•updated Aug 29, 2024•1•0•22

Detects attempts to bypass AMSI (Antimalware Scan Interface) using .NET reflection. This technique involves manipulating the 'amsiInitFailed' field within 'System.Management.Automation.AmsiUtils' to disable AMSI scanning, often seen in PowerShell scripts to evade detection.