AMSI Patch Attempt via AmsiScanBuffer/AmsiScanString Modification

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects command-line activity indicating an attempt to bypass or tamper with Anti-Malware Scan Interface (AMSI) functionality. The rule flags processes invoking GetProcAddress or LoadLibrary to resolve and manipulate AMSI-specific functions like AmsiScanBuffer or AmsiScanString within amsi.dll, a common technique for disabling runtime script scanning.