SNOWLIGHT AMSI Bypass - amsi.dll Load then VirtualProtect PAGE_EXECUTE_READWRITE

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule detects processes that load 'amsi.dll' followed by a call to 'VirtualProtectApiCall' with 'PAGE_EXECUTE_READWRITE' memory protection flags within a 30-second window. This behavioral pattern is frequently used in fileless execution techniques to disable Antimalware Scan Interface (AMSI) or to facilitate the execution of shellcode by modifying memory permissions.