AMSI Memory Patching via .NET Reflection

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects runtime method handle patching via the Marshal class targeting AMSI's ScanContent method. Adversaries overwrite method pointers in memory to redirect execution away from monitored code paths, effectively bypassing AMSI scanning by replacing the ScanContent function under "System.Management.Automation.AmsiUtils" with an empty or attacker-controlled method.

2026-06-01 00:00:00

None

c49bd8b5-3a19-4167-8716-6c4f8736f25a

attack.defense-impairment attack.t1685 attack.execution attack.t1059.001

Nextron Sigma feed only (private)