AI Impersonation PowerShell ETW/AMSI Disable

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Detects the infostealer disabling ETW and AMSI by setting the m_enabled flag to 0 in memory.