SUSP AMSI Bypass Memory Patching
Detects files containing code to perform an AMSI (Antimalware Scan Interface) bypass via memory patching. This technique involves locating and overwriting the beginning of AMSI scanning functions, like AmsiScanBuffer, to force them to return a clean result, thus evading detection. This is a common TTP used by various malware, including Donut-generated shellcode.
YARA
