XWorm - In-Memory AMSI Buffer Patching (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•5

Hunts for the Python process utilizing ctypes bindings to dynamically resolve VirtualProtect and patch the AmsiScanBuffer. This rule specifically looks for 'WriteProcessMemoryApiCall' events where the initiating process is 'python.exe' and the target memory address is within the 'amsi.dll' module.