AMSI Fail-Open Exploitation via Null pAppName Pointer - PowerShell ScriptBlock
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by manipulating memory structures or using reflection to nullify security checks. The rule looks for signatures of commonly used bypass techniques, such as using Marshal to overwrite amsiContext, calling GetDelegateForFunctionPointer with null/IntPtr.Zero arguments to target AmsiInitialize/AmsiScanBuffer, or declaring unusual DllImport signatures for amsi.dll functions within PowerShell script blocks.
Microsoft Sentinel (KQL)
