A lab writeup argues AMSI is failing open in places where PowerShell and the scanner share a process, then walks through six bypass classes across PowerShell 5.1 and 7. The strongest reason to click is the detection section, which says script block logging and memory or patch inspection still matter when line-by-line signatures miss the primitives.