AMSI In-Memory Patch via VirtualProtect on amsi.dll from Office or Script Interpreter

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects unauthorized modification of the amsi.dll memory space using process access operations such as VirtualProtect. This behavior is a common technique used by malware and scripts to disable the Antimalware Scan Interface (AMSI) in-memory, allowing for the execution of malicious payloads without triggering security product alerts. The rule specifically monitors for sensitive process access granted to amsi.dll originating from high-risk parent processes such as PowerShell, script interpreters, and Microsoft Office applications.