AMSI Bypass: Marshal.WriteInt64 pAppName Null Write via PowerShell

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by executing PowerShell commands that manipulate memory structures directly. Specifically, it looks for the use of the Marshal.WriteInt64 method to nullify the pAppName pointer at offset 0x08 within the AMSI_CONTEXT_INTERNAL structure, a known technique to disable AMSI scanning for the current process.