AMSI bypass test

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Executes the classic AMSI bypass on the test host, validating that detection of the AMSI evasion works (or that the EDR blocks it).

Run it in the purple team lab when you want to validate the evasion layer: the classic bypass (amsiInitFailed) disables AMSI in the PowerShell process and the team verifies what was detected — Event 4104 (the bypass script logged by ScriptBlock Logging), SIEM rules (AMSI bypass patterns), the EDR. It's the evasion validation: if AMSI is disabled without detection, the rest of the PowerShell arsenal runs without the scanner. In purple teaming, the AMSI bypass validates the evasion detection layer (and that of AMSI itself).

Do not run it outside the lab: the bypass disables AMSI in the process (the rest of the session remains without the scanner) — the test host is the place. And note: the classic bypass is old and well-known — modern EDRs detect it by pattern (AmsiUtils strings, reflection) and PowerShell patches mitigate it; the validation measures whether that layer is built. Modern bypasses (the 2023+ family) evade classic patterns: validation with the classic bypass covers detection of known patterns; new ones are validated separately. The PowerShell session with AMSI disabled is closed upon completion.