LCRYX AMSI Bypass and Event Log Clearing via PowerShell and wevtutil

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.