SNOWLIGHT AMSI Bypass via amsi.dll Memory Patch by Non-AV Process

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the SNOWLIGHT dropper performing an Antimalware Scan Interface (AMSI) bypass. The rule identifies processes that load 'amsi.dll' and subsequently perform memory manipulation (WriteProcessMemory or VirtualProtect) on the module's memory region within a 10-second window, excluding known Windows security components.