PowerShell Script Block Logging AMSI Bypass Primitives via Event ID 4104
Detects specific PowerShell Script Block Logging (Event ID 4104) patterns associated with Anti-Malware Scan Interface (AMSI) bypass techniques. The rule flags suspicious script content involving DynamicMethod IL emission, Marshal.WriteInt64 memory modification, or reflection-based manipulation of AmsiUtils fields, which are common indicators of attempts to disable or impair security inspection mechanisms in PowerShell environments.
Microsoft Sentinel (KQL)
