Bypassing AMSI With Reflection in PowerShell
As demonstrated, AMSI passes every PowerShell command through
Windows Defender’s signature detection before executing it.
One way to evade AMSI is to obfuscate and encode our PowerShell commands and scripts
but this could eventually become an exhausting game of “cat and mouse”.
In this section, we’ll take a much simpler approach
and attempt to halt AMSI without crashing PowerShell.
To do this, we’ll investigate two bypass techniques that rely on reflection
and will allow us to interact with internal types
and objects that are otherwise not accessible.