Codex - AMSI Patching via WriteProcessMemory
This rule detects attempts to bypass AMSI (Antimalware Scan Interface) by overwriting the AmsiScanBuffer function in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events where the target address is within the memory region of 'amsi.dll', indicating a potential in-memory patch to disable endpoint telemetry.
Microsoft Sentinel (KQL)
