Bypass Record
AMSI Bypass × Microsoft Windows AMSI
A publicly-reported instance of AMSI Bypass bypassing Microsoft Windows AMSI, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Script 1 performs an in-memory patch of the AmsiScanBuffer function by loading amsi.dll, locating the function address, changing memory protection, and overwriting it with assembly instructions (mov eax, 0x80070057; ret) to force AMSI to return a failure code, effectively disabling scanning. Script 2 is a simple TCP reverse shell that connects back to an attacker-controlled host.
Detection & mitigation
Monitor for PowerShell script block logging (Event ID 4104) and module logging (Event ID 4103) for signs of AMSI tampering, such as calls to VirtualProtect on AmsiScanBuffer or loading amsi.dll with subsequent memory patching. Mitigate by enabling constrained language mode, script block logging, and using application control to block unsigned scripts.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.