AMSI Bypass via DynamicMethod IL Emission in PowerShell 7 (pwsh.exe)
Detects the use of System.Reflection.Emit.DynamicMethod in PowerShell to dynamically compile and execute Intermediate Language (IL) code. This technique is commonly used to patch AMSI internals, specifically by modifying 's_amsiInitFailed' to bypass scanning capabilities.
YARA-L
