> Technique · AMSI Bypass via Byte-Signature Patching_

~/packetpursuit $ cat /intel/techniques/amsi-bypass-byte-patch.md

typetechniqueconfidencehighcreated2026-07-01updated2026-07-01defense-evasionamsidotnetin-memory-patchmalware-technique

AMSI Bypass via Byte-Signature Patching

Description

A .NET defense-evasion technique in which the malware dynamically resolves amsi.dll exports (AmsiInitialize, AmsiOpenSession, AmsiScanBuffer), then scans the function prologues for known byte signatures (e.g., 0x8B, 0xFF, 0x55, 0x48) and overwrites them with a benign stub (typically mov eax, 0; ret or equivalent). This neutralizes Windows Antimalware Scan Interface (AMSI) in the current process without terminating the service or touching disk.

Why It Works

AMSI operates in-process. By patching the function bytes in the loaded module's .text section, all subsequent calls to AmsiScanBuffer return AMSI_RESULT_CLEAN (0), allowing the payload to execute without triggering AMSI-integrated scanners (Defender, ATP, etc.).

Static Indicators

  • Method names like Get_AmsiOpenSession_Byte, Get_AmsiScanBuffer_Byte, AmsiInitialize in CIL metadata
  • LoadLibrary("amsi.dll") / GetProcAddress pairs
  • VirtualProtect to mark the target page PAGE_EXECUTE_READWRITE before patching
  • Absence of normal AMSI API call patterns (the malware never actually calls AmsiScanBuffer with a real buffer — it only resolves and patches)

Notable Examples

  • unclassified-dotnet-crypter-loader sibling 931242f8... — unobfuscated .NET 4.8 loader with explicit Get_AmsiOpenSession_Byte and Get_AmsiScanBuffer_Byte methods, alongside AmsiInitialize, AmsiOpenSession, and AmsiScanBuffer strings. ^[sample 931242f8/strings.txt:100-102]

  • unclassified-dotnet-crypter-loader sibling 673e6738... — unobfuscated .NET 4.0+ loader with identical AMSI bypass method names and Amsi_dll P/Invoke string. ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]

  • unclassified-dotnet-crypter-loader sibling 4e31a886... — unobfuscated .NET 4.5.1 loader with identical AMSI bypass method names. ^[/intel/analyses/4e31a886cd81ca02100d96b6b1475085dbe02d7c6f3fc72604be3ae64a56d1e8.html]

  • unclassified-dotnet-crypter-loader sibling 5f54948e... — .NET 4.0+ loader with Unicode control-character / Hangul jamo CIL name obfuscation, but plaintext Get_AmsiOpenSession_Byte, Get_AmsiScanBuffer_Byte, Get_ComplementaryStrings_Byte, AmsiInitialize, AmsiOpenSession, AmsiScanBuffer, and Amsi_dll strings survive in metadata. Sixth confirmed sibling. ^[/intel/analyses/5f54948ef4ea19feac07408f4109df54c07137d35b34804250cd20eeccfcd254.html]

Detection

  • ETW / AMSI event logs showing AmsiScanBuffer returning 0 immediately after process start
  • Memory scans for the byte sequence B8 00 00 00 00 C3 (x86 mov eax, 0; ret) at the start of AmsiScanBuffer
  • Suspicious VirtualProtect on amsi.dll mapped pages

Related