PowerShell Reflection-Based AMSI Bypass via amsiInitFailed Manipulation
Detects the use of PowerShell command-line arguments and reflection techniques commonly associated with attempting to bypass the Antimalware Scan Interface (AMSI). The rule uses a scoring mechanism to weight various keywords related to .NET reflection and AMSI-specific structures found in the command line.
Cortex XDR
