AMSI Fail-Open Bypass via Marshal.WriteInt64 Null pAppName (AmsiUtils)
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. These techniques typically involve memory manipulation (e.g., using Marshal.WriteInt64) to overwrite AMSI structures within the PowerShell process, effectively rendering AMSI ineffective for script content scanning.
Splunk (SPL)
