AMSI JIT Heap Patch via VirtualProtect and Marshal.Copy in PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects the execution of PowerShell scripts attempting an in-memory AMSI bypass by patching the AMSI scan content handler. The rule identifies suspicious combinations of .NET reflection and memory protection APIs (such as RuntimeHelpers.PrepareMethod, VirtualProtect, and Marshal.Copy) commonly utilized to overwrite AMSI function pointers or return values during runtime.