PowerShell ETW and AMSI Bypass via Reflection

Ethan Andrews@eandrews

•updated Feb 20, 2026•7•0•90

Detects PowerShell scripts using .NET Reflection to modify internal fields to disable Event Tracing for Windows (ETW) or the Anti-Malware Scan Interface (AMSI). This technique is used by malware like the MIMICRAT loader to evade defenses before executing its main payload.