Lightlife RAT AMSI Bypass via AmsiUtils amsiInitFailed Reflection

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. The detection monitors for the presence of specific keywords and method calls in script content, such as 'AmsiUtils', 'amsiInitFailed', and reflection-based attempts to modify memory buffers used by AMSI to scan for malicious scripts.