Bypass Record
AMSI Bypass × Microsoft AMSI
A publicly-reported instance of AMSI Bypass bypassing Microsoft AMSI, recorded with its original source. Factual record; no assessment of any specific deployment.
Reported as
LightsOut generates a DLL that patches AMSI and ETW in-memory using methods like direct patching, hardware breakpoints, or remote process patching.
Mechanism
LightsOut generates a DLL that patches AMSI and ETW in-memory using methods like direct patching, hardware breakpoints, or remote process patching. It obfuscates the DLL by randomizing WinAPI function names, XOR-encoding strings, and employing sandbox evasion checks to avoid static and dynamic analysis by AV/EDR.
Detection & mitigation
Monitor for suspicious in-memory patching of AMSI and ETW-related functions (e.g., AmsiScanBuffer, EtwEventWrite) via tools like Sysmon Event ID 10 (ProcessAccess) or Event ID 8 (CreateRemoteThread) targeting security-sensitive processes. Deploy AMSI and ETW integrity checks, enable tamper protection, and restrict debug privileges to prevent unauthorized patching.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.