AMSI Bypass via DynamicMethod IL Emission Targeting s_amsiInitFailed in PowerShell 7
Detects the use of System.Reflection.Emit.DynamicMethod and ILGenerator in PowerShell 7 scripts to perform an AMSI bypass. The attack works by emitting IL opcodes to directly modify the internal 's_amsiInitFailed' field within the AmsiUtils class, bypassing the initonly constraint to disable AMSI scanning.
Sigma
