AMSI In-Process Memory Patch via VirtualProtect or Marshal.Copy on amsi.dll

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects in-process memory manipulation of amsi.dll (AmsiScanBuffer/AmsiScanString) within PowerShell script block logs (Event ID 4104). This activity often involves using VirtualProtect or Marshal.Copy to apply an in-memory patch (e.g., return-early 0xC3) to neutralize AMSI scanning capabilities, which is a common technique for bypassing defensive security controls.