Bypass Record
AMSI Bypass × Microsoft Windows Defender
A publicly-reported instance of AMSI Bypass bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The technique patches the AmsiOpenSession function by setting the RCX register to 0, causing it to return E_INVALIDARG. Alternatively, patching AmsiScanBuffer sets RAX to E_INVALIDARG and returns immediately, bypassing scanning. The AmsiScanBuffer method defeats AMSI for .NET Assembly.Load() calls.
Detection & mitigation
Monitor for suspicious memory modifications to AMSI-related DLLs (e.g., amsi.dll) using kernel callbacks or ETW providers like Microsoft-Windows-Threat-Intelligence. Deploy endpoint detection rules that alert on WriteProcessMemory or NtWriteVirtualMemory calls targeting AMSI functions, and enforce Windows Defender Application Control (WDAC) to restrict untrusted code execution.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.