Bypass Record
AMSI Bypass × Microsoft AMSI
A publicly-reported instance of AMSI Bypass bypassing Microsoft AMSI, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Uses 13-byte jmp trampolines to redirect AmsiScanBuffer to a proxy that returns AMSI_RESULT_CLEAN, and EtwpEventWriteFull to a stub that returns immediately, effectively disabling AMSI scanning and ETW logging.
Detection & mitigation
Monitor for modifications to AMSI-related functions (e.g., AmsiScanBuffer) in memory, such as inline hooks or trampolines, using integrity checks or kernel callbacks. Deploy AMSI provider hardening and enable tamper protection to prevent unauthorized patching.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.