Bypass Record
AMSI Bypass × SentinelOne EDR
A publicly-reported instance of AMSI Bypass bypassing SentinelOne EDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A .NET loader uses hardware breakpoints to hook AMSI and ETW, preventing SentinelOne from inspecting malicious .NET assemblies. AES encryption obfuscates the payload. The loader then executes Rubeus in memory to perform S4U constrained delegation, impersonating a Domain Admin without triggering EDR detections.
Detection & mitigation
Monitor for suspicious use of hardware breakpoints (e.g., via ETW or kernel callbacks) and unexpected AMSI/ETW unhooking. Deploy memory scanning and behavioral analysis to detect in-memory .NET assembly loads that bypass AMSI. Ensure EDR tamper protection is enabled and monitor for agent health signals.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.