AMSI Bypass.

The Antimalware Scan Interface (AMSI), introduced with Windows 10 in 2015, lets PowerShell, JScript, VBScript, .NET, and Office VBA submit buffers to the registered antivirus (via AmsiScanBuffer/AmsiScanString) for scanning after deobfuscation but before execution. Because AMSI runs in-process and shares the attacker's address space, an attacker who already has code execution can simply tamper with it.

Common techniques fall into three families. Memory patching overwrites the first bytes of amsi.dll!AmsiScanBuffer (or AmsiOpenSession) so it returns AMSI_RESULT_CLEAN or an error like E_INVALIDARG without scanning. Reflection flips PowerShell's private AmsiUtils.amsiInitFailed field to true — Matt Graeber's classic 2016 one-liner — so the session never initialises AMSI again. Obfuscation/downgrade splits flagged strings, Base64-encodes them, or forces powershell -version 2 where AMSI does not exist. The aim is to run tooling such as Mimikatz, Invoke-Mimikatz, or Cobalt Strike beacons inside a trusted host process undetected.

MITRE ATT&CK tracks these as T1562.001 (Impair Defenses: Disable or Modify Tools). Microsoft Defender has signatured the literal amsiInitFailed string since 2017, so attackers obfuscate it at runtime. Defences: AMSI providers wired to a modern EDR, Attack Surface Reduction rules, PowerShell Constrained Language Mode, AppLocker/WDAC, ScriptBlock logging, and alerting on writable+executable patches to amsi.dll in newly spawned processes.

flowchart TD
  S[Malicious script / macro] --> H[Host process: PowerShell, WScript, Office]
  H --> Q{AMSI tampered?}
  Q -->|"Patch AmsiScanBuffer"| C[Force AMSI_RESULT_CLEAN]
  Q -->|"Set amsiInitFailed = true"| C
  Q -->|"No"| AV[AV/EDR scans deobfuscated buffer]
  AV -->|Malicious| B[Blocked + alert]
  AV -->|Clean| X[Execute]
  C --> X[Payload executes unscanned]