AMSI patch via VirtualProtect + AmsiScanBuffer base64 reflection in PowerShell

Duo Tech@duotech

•updated Jul 9, 2026•2•0•4

Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by invoking memory manipulation techniques. The rule monitors for the usage of 'VirtualProtect', 'GetProcAddress', and 'LoadLibrary' in combination with AMSI-specific strings (e.g., 'AmsiScanBuffer', 'amsi.dll') and the .NET 'Runtime.InteropServices.Marshal' namespace, which are indicative of an in-memory AMSI patch or obfuscation.