AMSI Memory Patching via .NET Reflection - PowerShell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious PowerShell script blocks that attempt to patch AMSI's ScanContent method in memory using the Marshal class. This technique is used by adversaries to bypass AMSI scanning by replacing the ScanContent function under "System.Management.Automation.AmsiUtils" with an empty or attacker-controlled method.

2026-06-01 00:00:00

None

9e7f2a3b-5c1d-4e8f-b6a2-1d3e5f7a9b0c

attack.defense-impairment attack.t1685 attack.execution attack.t1059.001

Nextron Sigma feed only (private)