PowerShell DynamicMethod IL Emission to Bypass AMSI via s_amsiInitFailed
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) by dynamically generating and emitting malicious Intermediate Language (IL) code at runtime. It monitors Event ID 4104 for specific patterns, such as the use of 'System.Reflection.Emit', 'AmsiUtils', or 's_amsiInitFailed', which are indicative of techniques designed to manipulate in-memory structures to disable AMSI protections.
Splunk (SPL)
