Potential AMSI Bypass Via .NET Reflection

Title: Potential AMSI Bypass Via .NET Reflection
Status: test
Description:Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
References:
  -https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
  -https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
Author: Markus Neis, @Kostastsale
Date: 2018-08-17
modified:2023-02-03
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    - CommandLine|contains|all:
      - 'System.Management.Automation.AmsiUtils'
      - 'amsiInitFailed'
    - CommandLine|contains|all:
      - '[Ref].Assembly.GetType'
      - 'SetValue($null,$true)'
      - 'NonPublic,Static'
  condition:selection
Falsepositives:
  -Unlikely
Level: high