AMSI amsiInitFailed Reflection Bypass in PowerShell 5.1 (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 5.1 by using .NET reflection to manipulate the 'amsiInitFailed' field within the 'AmsiUtils' class. The rule monitors both script block logs and command-line arguments for patterns involving reflective field access, string concatenation of sensitive keywords, and reflection binding flags.