AMSI Fail-Open via pAppName Null Pointer Write - Marshal.WriteInt64

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.