AMSI Bypass × Microsoft Defender for Endpoint

The technique prevents MDE's AMSI integration from scanning script content

The bypass targets how MDE loads its AMSI provider DLL (MpOav.dll). By manipulating the provider registration or loading process, the technique prevents MDE's AMSI provider from being invoked when scripts are submitted for scanning, effectively disabling AMSI-based inspection for MDE without disabling AMSI entirely.

Monitor for unexpected AMSI provider registration changes or failures to load MpOav.dll, such as missing or tampered registry keys under HKLM\SOFTWARE\Microsoft\AMSI\Providers. Mitigation: enforce tamper protection, restrict administrative privileges, and use endpoint detection rules that alert on AMSI provider load failures or suspicious script host behavior.