TELEPUZ AMSI Patch via rundll32 Loading amsi.dll from Known DLL Paths
Detects the loading of amsi.dll by rundll32.exe when invoked with specific command-line arguments. This pattern is associated with the TELEPUZ malware, which leverages this technique to patch the AmsiScanBuffer function in memory, effectively disabling AMSI (Antimalware Scan Interface) scanning for the process.
Microsoft Sentinel (KQL)
