AMSI AmsiScanBuffer Byte-Patch via VirtualProtect and Marshal.WriteByte in PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects PowerShell execution attempts that include strings associated with Anti-Malware Scan Interface (AMSI) bypass techniques. Specifically, it searches for command-line arguments that attempt to manipulate memory (VirtualProtect, Marshal.WriteByte, RtlMoveMemory) or interact with AMSI/PowerShell internals (AmsiScanBuffer, amsi.dll) commonly used to disable AMSI scanning within a running process.