AMSI Bypass Techniques and Defensive Hardening

Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these techniques against systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal in virtually every jurisdiction and can carry severe penalties.

Introduction

The Antimalware Scan Interface inspects scripts before execution, and attackers routinely try to neutralize it.

Bypasses patch the in-process AMSI functions or corrupt its context.

How It Works

AMSI runs in the script host’s process, so an attacker with code execution there can tamper with it.

This is detection evasion, not a privilege gain.

Walkthrough

A representative in-memory AMSI tamper (detected by modern EDR):

[Ref].Assembly.GetType('...AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

[Ref].Assembly.GetType('...AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Review PowerShell script-block logs for tampering:

Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 50

Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 50

Detection and Defense

Enable script-block and module logging, constrained language mode, and EDR that monitors AMSI integrity.

Treat AMSI tampering events as high-severity.

Conclusion

AMSI bypasses are an arms race fought in-process; rich script logging and EDR integrity checks expose them.

You Might Also Like

If you found this useful, these related deep-dives cover adjacent techniques and their defenses:

• AMSI and Windows Defender Bypass: A Practical Primer
• PowerShell Obfuscation and Execution Policy Bypass
• Deobfuscating Malicious PowerShell for Analysts
• Anti-Debugging and Unpacking Malware Samples