EDR Evasion Techniques and Detection: Syscall Abuse, Unhooking, and Telemetry Integrity

title: AMSI Bypass via PowerShell .NET Reflection (AmsiUtils)
id: a3f8d2b1-5c47-4e90-b3a2-9f1e6d87c034
status: experimental
description: |
  Detects AMSI bypass attempts using .NET reflection to set amsiInitFailed to true
  via System.Management.Automation.AmsiUtils. This is a common technique used by
  threat actors and red teams to disable AMSI scanning of PowerShell script blocks.
  AI-generated / unvalidated — review before production deployment.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml
  - https://radiantsec.io/docs/redteam/bypass-amsi/
  - https://detection.fyi/tsale/sigma_rules/misc/proc_creation_windows_amsi_bypass/
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  product: windows
  category: ps_script
  definition: 'Requires PowerShell Script Block Logging (Event ID 4104) to be enabled'
detection:
  selection_amsi_reflection:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'System.Management.Automation.AmsiUtils'
      - 'amsiInitFailed'
  selection_amsi_setvalue:
    EventID: 4104
    ScriptBlockText|contains|all:
      - '[Ref].Assembly.GetType'
      - 'SetValue($null,$true)'
      - 'NonPublic,Static'
  selection_amsi_setvalue_alt:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'GetField'
      - 'amsiInitFailed'
      - 'SetValue'
  condition: 1 of selection_*
falsepositives:
  - Legitimate security testing frameworks (Cobalt Strike, Metasploit) in authorized red team exercises
  - Security research environments
level: high