Shellcode Loader Patches AmsiScanBuffer and EtwEventWrite via VirtualProtect
Detects instances where a process attempts to change memory permissions (using VirtualProtect) on sensitive security-related modules 'amsi.dll' or 'ntdll.dll'. This is a common technique used by shellcode loaders and malware to disable Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) by patching their respective scan functions in memory.
Sigma
