AMSI Bypass via pAppName Null Pointer Write to Exploit Fail-Open Design
This rule detects PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by using .NET reflection techniques. The detection monitors for common class and method names (e.g., 'AmsiUtils', 'Marshal.WriteInt64') utilized by attackers to disable or tamper with AMSI's memory structures within a running PowerShell process.
Cortex XDR
