PowerShell AMSI Bypass via WriteInt32

Tim Peck@timpeck

•updated May 6, 2026•18•0•1,142

Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning. This technique was notably observed in the InstallFix campaign delivering RedLine Stealer.