Windows: .NET Reflection Attempt to Disable AMSI via amsiInitFailed

title: "Windows: .NET Reflection Attempt to Disable AMSI via amsiInitFailed"
id: 60606a36-7f20-4afc-bf0f-379987c1ada3
related:
  - id: 4f927692-68b5-4267-871b-073c45f4f6fe
    type: obsolete
  - id: 30edb182-aa75-42c0-b0a9-e998bb29067c
    type: derived
status: test
description: This rule flags process creation events where the command line references PowerShell AMSI utilities and specifically the string "amsiInitFailed". It also matches .NET reflection usage patterns that set a non-public static value to $null/$true, which can be used to impair AMSI scanning. The detection relies on Windows process command-line telemetry and string matches within the PowerShell/.NET invocation.
references:
  - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
  - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml
author: Markus Neis, @Kostastsale, Huntrule Team
date: 2018-08-17
modified: 2023-02-03
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
        - System.Management.Automation.AmsiUtils
        - amsiInitFailed
    - CommandLine|contains|all:
        - "[Ref].Assembly.GetType"
        - SetValue($null,$true)
        - NonPublic,Static
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1