SNOWLIGHT AMSI Bypass via AmsiScanBuffer In-Memory Patch and VirtualProtect

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring memory protection changes (VirtualProtect) targeting the AmsiScanBuffer function within the amsi.dll module. Attackers often modify this function's memory permissions to PAGE_EXECUTE_READWRITE to inject code or patch the function, effectively disabling AMSI scanning capabilities.