CountLoader 4.5p AMSI Bypass via .NET Reflection and D/Invoke
Detects malicious PowerShell activity attempting to bypass the Antimalware Scan Interface (AMSI) by identifying command-line patterns associated with 'CountLoader' and similar malware. It targets the use of .NET reflection to manipulate AmsiUtils fields and the use of dynamic function resolution (D/Invoke) techniques via GetDelegateForFunctionPointer and GetProcAddress to evade static detection.
Microsoft Sentinel (KQL)
