PowerShell Script Block Logging AMSI Bypass Patterns (Event ID 4104)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, obfuscated method calls, and manipulation of internal AMSI/ETW structures (e.g., AmsiScanBuffer, AmsiUtils, Marshal.WriteInt64) within PowerShell Script Block logs (Event ID 4104).