Index / AMSI Bypass / Microsoft
Bypass Record

AMSI Bypass × Microsoft Windows AMSI

A publicly-reported instance of AMSI Bypass bypassing Microsoft Windows AMSI, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
Microsoft Windows AMSI
Technique
AMSI Bypass
MITRE ATT&CK
T1562.001
Confidence
High
Severity
High
Status
poc
Disclosed
2025-06-06
Config / version noted
Not stated

Provenance

Reported as

Sets hardware breakpoints on the AmsiScanBuffer function to intercept and modify its behavior, preventing AMSI from scanning buffer contents.

Mechanism

Sets hardware breakpoints on the AmsiScanBuffer function to intercept and modify its behavior, preventing AMSI from scanning buffer contents. This defeats AMSI's ability to detect malicious scripts or code in memory.

Detection & mitigation

Monitor for suspicious use of debug registers (DR0-DR3) via ETW events (e.g., Microsoft-Windows-Kernel-Process) or kernel callbacks, and deploy AMSI provider integrity checks to detect tampering. Mitigate by enabling hypervisor-protected code integrity (HVCI) and Credential Guard to restrict hardware breakpoint abuse.

AMSI Bypass has also been recorded against

Any security vendor relying on AMSICrowdStrikeMcAfeePalo Alto NetworksSentinelOneSophosTrellix

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.