Loading story…
Threat researchers report that attackers and malware operators continue to bypass Microsoft’s Antimalware Scan Interface (AMSI) on Windows, weakening a key inspection layer for PowerShell and other script-based activity. Recent telemetry highlighted two dominant techniques: tampering with PowerShell’s AmsiUtils state, including the amsiInitFailed flag, and patching AMSI-related code in memory—especially AmsiScanBuffer or amsi.dll—to force scan failures. Sophos said memory-patching now accounts for most observed AMSI bypass attempts and has appeared in activity involving Cobalt Strike, Agent Tesla downloaders, WannaMine, and intrusions linked to ProxyLogon exploitation.
Separate research showed that an older AMSI bypass using DLL hijacking can still work by planting a fake amsi.dll with the expected exports in specific directories, in some cases even without elevated privileges. SensePost said Microsoft did not assign a CVE because AMSI is not treated as a security boundary, but Windows Defender added detections that reduce the technique’s reliability for low-privileged users, and the PowerShell team was reported to be working on a fix. Researchers also noted that attackers may sidestep AMSI through PowerShell version downgrades, alternate scripting engines such as jscript or cscript, or other evasive tradecraft, reinforcing that AMSI should be backed by defense in depth and timely patching rather than relied on as a standalone control.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
In a 90-day telemetry period from February to May 2021, Sophos found that more than 98 percent of AMSI bypass attempts involved tampering with AMSI code in memory, while amsiInitFailed-based bypasses accounted for about 1 percent.
Windows Defender added detection for the AMSI DLL hijack technique, including detecting copied amsi.dll files in user-writable folders, reducing the technique's effectiveness for low-privileged users.
Matt Graeber published a one-line AMSI bypass that sets PowerShell's amsiInitFailed flag to true, causing the current PowerShell process to stop requesting AMSI scans.
The AMSI DLL hijacking issue was reported to the Microsoft Security Response Center, but Microsoft did not assign a CVE because AMSI was not considered a security boundary.
Microsoft introduced the Antimalware Scan Interface (AMSI) to let software request malware scans of files, memory, and streams in a vendor-agnostic way on Windows systems.
In March, Sophos detected repeated attempts to install a WannaMine payload on a customer's systems; one unprotected Windows system was infected while protected systems blocked execution despite continued spread attempts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public offensive tooling and research continue to show how attackers can weaken PowerShell defenses by bypassing **AMSI**, suppressing **Script Block Logging**, and evading **Constrained Language Mode**. MDSec documented several methods, including flipping the private `.NET` flag `System.Management.Automation.AmsiUtils.amsiInitFailed`, patching `amsi.dll` in memory, forcing `AmsiOpenSession` failures, altering cached Group Policy settings to disable logging, and clearing PowerShell's suspicious signature list to reduce forced logging. The techniques were later operationalized in tools such as **Stracciatella**, a C# runspace launcher that executes PowerShell while attempting to disable AMSI, ETW, and logging at startup, supports encoded input and named-pipe command delivery, and was promoted for use with frameworks including **Cobalt Strike** and **BOF.NET**. Separate research also showed that AMSI itself can be abused for persistence by registering a malicious **AMSI provider** DLL as a COM server under `HKLM`, allowing code to run whenever AMSI-inspected content matches a trigger while still returning `AMSI_RESULT_NOT_DETECTED`. In the demonstrated sample, the provider watched for a specific string and launched `calc.exe`, highlighting how AMSI can be turned from a scanning interface into an execution mechanism. Defenders were advised to monitor unsigned DLL loads by PowerShell and registry changes affecting AMSI provider and `InprocServer32` entries, as these tradecraft patterns can support stealthy post-exploitation and long-term Windows persistence.
Aug 15, 2026
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
Microsoft has disclosed a sustained series of **security feature bypass** vulnerabilities across Windows and related components, with multiple advisories tied to **Mark of the Web (MotW)**, **SmartScreen**, **MapUrlToZone**, Windows shortcut handling, and security zone mapping. The most detailed recent case, `CVE-2026-32225`, affects **Windows Shell** and allows attackers to bypass SmartScreen protections that rely on MotW by persuading a user to open a specially crafted `.lnk` file. Microsoft said successful exploitation could cause Windows to launch commands or Control Panel applets without proper MotW handling, potentially enabling arbitrary command execution or the loading of attacker-controlled DLLs; the flaw was rated **Important**, assigned a **CVSS 8.8**, marked as **more likely to be exploited**, and fixed at disclosure. The newer Windows Shell issue follows a broader pattern of Microsoft fixes for related bypasses, including `CVE-2022-44698` in **Windows SmartScreen**; `CVE-2023-36564` in **Windows Search**; `CVE-2023-36584`, `CVE-2024-38217`, and `CVE-2024-43487` in **Windows Mark of the Web**; `CVE-2024-30073` in **Windows Security Zone Mapping**; `CVE-2025-21328`, `CVE-2025-21329`, and `CVE-2025-21332` in **MapUrlToZone**; and `CVE-2025-47160` in **Windows Shortcut Files**. Additional bypass advisories affected Microsoft products including **Publisher**, **Office Developer Platform**, **PowerShell**, **Kerberos**, **Windows Hello**, **Surface**, and **PC Manager**, underscoring Microsoft's continued effort to close gaps in trust labeling and execution safeguards that attackers can abuse to reduce warnings and increase the success of social-engineering attacks.
Jun 29, 2026