https://www.trendmicro.com/en_us/research/22/l/detecting-windows-amsi-bypass-techniques.html