CRPx0 AMSI/ETW Runtime Patching via VirtualProtect on Security DLLs

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects suspicious processes attempting to open security-critical DLLs like amsi.dll or ntdll.dll with potential write or execute access. This behavior is often associated with runtime patching techniques used to disable or evade AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) monitoring, which are common defensive evasion tactics.