AMSI Direct Memory Patch via AmsiScanBuffer/AmsiScanString (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects PowerShell processes (powershell.exe or pwsh.exe) attempting to execute commands that reference memory manipulation APIs (VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory) or strings associated with AMSI (Antimalware Scan Interface) bypass techniques (amsiscanbuffe, amsiscanstri, amsi.dll). These techniques are commonly used to disable security controls or inject shellcode into memory.