AMSI and ETW In-Memory Patching by Python/PyInstaller Payload (Glove Stealer)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the loading of amsi.dll by potentially malicious Python-based processes (e.g., PyInstaller, scripts) or cross-process memory writes from such processes, which are indicative of in-memory patching of AMSI (AmsiOpenSession) or ETW (EtwEventWrite) to evade detection. The rule monitors for unsigned processes like 'python.exe' or 'winupdate.exe' performing these actions.