UAC-0226 AMSI Bypass: ETW PSEtwLog Suppression + AmsiInitFailed Chain
Detects attempts to suppress PowerShell ETW telemetry by modifying the PSEtwLog object (setting it to null or 0) in conjunction with indications that AMSI initialization has failed, suggesting a coordinated effort to blind security monitoring during malicious script execution.
SentinelOne
