Attackers Continue to Evade Windows AMSI With Memory Patching and DLL Hijacking

Threat researchers report that attackers and malware operators continue to bypass Microsoft’s Antimalware Scan Interface (AMSI) on Windows, weakening a key inspection layer for PowerShell and other script-based activity. Recent telemetry highlighted two dominant techniques: tampering with PowerShell’s AmsiUtils state, including the amsiInitFailed flag, and patching AMSI-related code in memory—especially AmsiScanBuffer or amsi.dll—to force scan failures. Sophos said memory-patching now accounts for most observed AMSI bypass attempts and has appeared in activity involving Cobalt Strike, Agent Tesla downloaders, WannaMine, and intrusions linked to ProxyLogon exploitation.

Separate research showed that an older AMSI bypass using DLL hijacking can still work by planting a fake amsi.dll with the expected exports in specific directories, in some cases even without elevated privileges. SensePost said Microsoft did not assign a CVE because AMSI is not treated as a security boundary, but Windows Defender added detections that reduce the technique’s reliability for low-privileged users, and the PowerShell team was reported to be working on a fix. Researchers also noted that attackers may sidestep AMSI through PowerShell version downgrades, alternate scripting engines such as jscript or cscript, or other evasive tradecraft, reinforcing that AMSI should be backed by defense in depth and timely patching rather than relied on as a standalone control.