AMSI Bypass × Microsoft Windows AMSI

bypasses the Antimalware Scan Interface (AMSI) by intercepting the loading of amsi.dll ... preventing AMSI initialization and thus disabling script content scanning

Intercepts LdrLoadDll (the final loader for LoadLibrary calls) to detect when amsi.dll is being loaded. When amsi.dll is requested, the technique returns an 'Access Denied' error, causing AMSI initialization to fail. This is achieved either by inserting an unconditional jump (hooking) to a custom LdrLoadDll that checks the DLL name, or by setting a hardware breakpoint on LdrLoadDll and in the exception handler checking the r8 register (third argument, dllName) for 'amsi.dll', then modifying the return address and rax to simulate failure. This bypasses AMSI because the CLR's AmsiScanBuffer check returns 'not detected' if amsi.dll fails to load.

Monitor for failed loads of amsi.dll (e.g., via Sysmon Event ID 7 with ImageLoaded events where SignatureStatus is 'Unavailable' or load failures logged by AMSI itself). Deploy AMSI provider integrity checks and use endpoint detection rules that alert on LdrLoadDll hooking or hardware breakpoint modifications.