AMSI Fail-Open Bypass: Null pAppName Passed to AmsiInitialize via P/Invoke

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring processes such as PowerShell, cscript, wscript, and mshta for command-line arguments that attempt to modify AMSI memory structures. It specifically looks for patterns involving AmsiInitialize, memory nullification, and the loading of amsi.dll using techniques like DllImport or Add-Type.