SilentCanvas - AMSI Bypass String Obfuscation

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

Detects fragmented string reconstruction techniques within PowerShell memory targeting IWR (Invoke-WebRequest) or IEX (Invoke-Expression). This rule specifically looks for PowerShell process command lines containing 'IWR' or 'IEX' with fragmented string obfuscation (e.g., I['']w['']r).