UAC-0226 AMSI Bypass via DynamicMethod IL Emission in PowerShell 7
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 (pwsh.exe) by utilizing System.Reflection.Emit to dynamically emit Intermediate Language (IL) code. This technique involves JIT heap patching where an attacker constructs a dynamic method to intercept or nullify AMSI scan functions (e.g., AmsiScanBuffer) within the runtime memory of the PowerShell process.
Microsoft Sentinel (KQL)
