AMSI JIT Heap Patch via PrepareMethod and Marshal WriteByte in pwsh.exe

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects attempts to patch AMSI (Antimalware Scan Interface) managed methods in PowerShell memory using JIT (Just-In-Time) compilation and memory write operations. The rule identifies suspicious combinations of terms related to method preparation, memory manipulation (via System.Runtime.InteropServices.Marshal), and direct references to AMSI components within PowerShell Script Block logs (Event ID 4104).