PowerShell Reflection AMSI Bypass via amsiInitFailed Field Manipulation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•2

This rule detects potential attempts to disable Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 using reflection-based manipulation of the amsiInitFailed boolean field in the System.Management.Automation.AmsiUtils class. Attackers often use obfuscation techniques such as splitting strings or using reflection methods to bypass static security signatures.