Bypass Record
AMSI Bypass × Trellix Endpoint Security
A publicly-reported instance of AMSI Bypass bypassing Trellix Endpoint Security, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Improper validation of user-controlled environment variables allows a local low-privilege user to set malicious values that interfere with the ENS AMSI component initialization, disabling it and enabling undetected malicious code execution.
Detection & mitigation
Monitor for unexpected modifications to environment variables (e.g., via process creation logs with suspicious parent-child relationships) that target security product components, and enforce application control to prevent unauthorized tampering with AMSI-related registry keys or process memory.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.