Bypass Record
AMSI Bypass × Microsoft Windows AMSI
A publicly-reported instance of AMSI Bypass bypassing Microsoft Windows AMSI, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Sets a hardware breakpoint on the AmsiScanBuffer function using CPU debug registers. When the breakpoint triggers during execution, the technique modifies the function's behavior in memory to bypass scanning, without altering the AMSI DLL on disk.
Detection & mitigation
Monitor for suspicious use of debug registers (e.g., via ETW events for thread context setting) or anomalous breakpoint exceptions targeting AMSI-related functions. Deploy kernel-level callbacks or hypervisor-based integrity checks to detect unauthorized debug register manipulation, and ensure AMSI is integrated with behavior-based detection to catch post-bypass malicious activity.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.