UAC-0226/AMSI Bypass via PowerShell Reflection on AmsiUtils GetField

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•9

Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to locate and modify the internal 'amsiInitFailed' or 's_amsiInitFailed' fields within the AmsiUtils class. This technique prevents PowerShell from correctly identifying or blocking malicious scripts by forcing the AMSI initialization status to a state indicating a failure has already occurred, effectively disabling the security engine for that session.