AMSI Bypass via PowerShell

api where process.Ext.api.name == "AmsiScanBuffer" and
 (process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
 (
  (process.Ext.api.parameters.buffer : ("*amsiContext*", "*amsiSession*", "*amsiInitFailed*", "*AmsiUtils*", "*AmsiInitialize*", "*AmsiScanString*") and
   process.Ext.api.parameters.buffer : "*.SetValue*" and process.Ext.api.parameters.buffer : "*.GetField*") or

  (process.Ext.api.parameters.buffer : "*[Ref].Assembly.GetType*System.Management.Automation.Amsi*" and
   process.Ext.api.parameters.buffer : "*.SetValue*" and process.Ext.api.parameters.buffer : "*.GetField*") or

  (process.Ext.api.parameters.buffer : "*[Ref].Assembly.GetTypes()*" and
   process.Ext.api.parameters.buffer : "*GetFields*" and process.Ext.api.parameters.buffer : ("*amsiIn*", "*iUtils*")) or

  (process.Ext.api.parameters.buffer : "*::AllocHGlobal*" and process.Ext.api.parameters.buffer : "*.NoRMALiZe*" and
   process.Ext.api.parameters.buffer : "*.SetValue*" and process.Ext.api.parameters.buffer : "*-replace*") or

  (process.Ext.api.parameters.buffer : "*System.Management.Automation.*" and process.Ext.api.parameters.buffer : "*.SetValue*" and
   process.Ext.api.parameters.buffer : ("*.GetField*NonPublic,Static*", "*FromBase64String*") and
    not (
      process.Ext.api.parameters.buffer : "*_outputEncoding*" and
      process.Ext.api.parameters.content_name in ("exec_wrapper.ps1", "exec_wrapper-async.ps1.ps1") and
      process.code_signature.subject_name : "Microsoft Windows" and process.code_signature.trusted == true
    )
  ) or

process.Ext.api.parameters.buffer :
                   ("*Invoke-AmsiBypass*",
                    "*AllocHGlobal*9076*",
                    "*cwBpAC4AZABsAGwA*",
                    "*41 6d 73 69 53 63 61 6e 42 75 66 66 65 72*",
                    "*5492868772801748688168747280728187173688878280688776828*")
  ) and
not process.parent.executable : "C:\\Program Files (x86)\\ManageSoft\\Tracker\\ndtrack.exe"