Bypass Record

AMSI Bypass × Trellix Endpoint Security

A publicly-reported instance of AMSI Bypass bypassing Trellix Endpoint Security, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
Trellix Endpoint Security
Technique
AMSI Bypass
MITRE ATT&CK
T1562.001
Confidence
High
Severity
Critical
Status
unknown
Disclosed
2023-10-04
Config / version noted
Yes

Provenance

Reported as

allows a local attacker to disable the AMSI component via environment variable manipulation

Mechanism

Improper validation of user-controlled environment variables allows a local low-privilege user to set malicious values that interfere with the ENS AMSI component initialization, disabling it and enabling undetected malicious code execution.

Detection & mitigation

Monitor for unexpected modifications to environment variables (e.g., via process creation logs with suspicious parent-child relationships) that target security product components, and enforce application control to prevent unauthorized tampering with AMSI-related registry keys or process memory.

AMSI Bypass has also been recorded against

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.