Bypass Record
AMSI Bypass × Palo Alto Networks Cortex XDR
A publicly-reported instance of AMSI Bypass bypassing Palo Alto Networks Cortex XDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The attack uses PowerShell ExecutionPolicy Bypass to run scripts, sets environment variables and registry keys under HKCU to enable COM profiler injection of a malicious DLL into PowerShell, then uses .NET reflection to set the internal amsiInitFailed flag to true, disabling AMSI scanning entirely. All steps operate in user context without elevated privileges, evading default Cortex XDR behavioral and BIOC detections.
Detection & mitigation
Monitor for PowerShell execution with ExecutionPolicy Bypass, registry modifications under HKCU\Software\Classes\CLSID for suspicious InprocServer32 entries, and use of .NET reflection to access AmsiUtils. Enable ScriptBlock, Module, and Transcription logging; create custom XQL/BIOC rules to alert on COM profiler environment variables (COR_ENABLE_PROFILING, COR_PROFILER) and correlate with DLL loads.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.