AMSI Bypass via In-Memory Patching of amsi.dll Exported Functions

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•8

This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.