In-Memory AMSI Bypass via Reflective LoadLibrary/GetProcAddress/VirtualProtect Patch

Duo Tech@duotech

•updated Jul 9, 2026•1•0•2

Detects execution of PowerShell commands that contain strings indicative of an in-memory AMSI (Antimalware Scan Interface) bypass. The rule searches for the combination of memory manipulation API calls (VirtualProtect, LoadLibrary, GetProcAddress) and specific byte signatures (0xB8, 0xC3) often used to patch AMSI in the current process memory.