PowerShell 7 JIT Heap Patch of AMSI WinScanContent via PrepareMethod

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects suspicious PowerShell script behavior that attempts to patch the Anti-Malware Scan Interface (AMSI) in-memory by manipulating internal .NET/CLR methods. It identifies the combination of dangerous API calls (e.g., VirtualProtect, Marshal.Copy, PrepareMethod) typically used to bypass AMSI scanning via JIT compilation patching targeting the WinScanContent method.