AMSI Bypass: InternalNotify vtable Patch + pAppName Null via PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•8

Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by patching the AMSI context in memory. The rule identifies the combination of using VirtualProtect via P/Invoke to modify memory protections, followed by using Marshal.WriteInt64 to overwrite the pAppName field in the AmsiContext structure. This technique is commonly used by obfuscated PowerShell scripts to evade signature-based detection.