AMSI AmsiScanBuffer Memory Patch via VirtualProtect or NtProtectVirtualMemory
This rule detects PowerShell script block execution that attempts to bypass the Antimalware Scan Interface (AMSI) by targeting memory structures. It identifies scripts invoking methods like VirtualProtect, NtProtectVirtualMemory, or WriteProcessMemory in conjunction with AMSI-related functions or DLL references, often indicating an attempt to disable or patch AMSI to execute malicious payloads without detection.
Splunk (SPL)
