Windows PowerShell AMSI Bypass Pattern: [Ref].Assembly.GetType and SetValue($null,$true)

title: "Windows PowerShell AMSI Bypass Pattern: [Ref].Assembly.GetType and SetValue($null,$true)"
id: 3c8a88db-dfa1-40b9-b962-552e92a06c4e
status: test
description: This rule matches PowerShell script content containing an AMSI bypass characteristic pattern that includes the reflection call '[Ref].Assembly.GetType' and a subsequent 'SetValue($null,$true)' with 'NonPublic,Static'. Attackers use reflection and obfuscated code to tamper with security mechanisms, and these strings are commonly present in short AMSI-evasion script fragments. It relies on Script Block Text telemetry from PowerShell script block logging to search for all specified substrings.
references:
  - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
  - https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-11-09
tags:
  - attack.defense-impairment
  - attack.t1685
  - attack.execution
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "[Ref].Assembly.GetType"
      - SetValue($null,$true)
      - NonPublic,Static
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e0d6c087-2d1c-47fd-8799-3904103c5a98
    type: derived