Advanced Evasion Techniques: Bypassing AMSI in Windows

Before Windows 10, scripting engines like PowerShell, VBScript, and JavaScript operated as a massive blind spot for security products. An attacker could run a deeply obfuscated, fileless PowerShell script entirely in memory, and the local Antivirus would have absolutely no visibility into what was happening.

To close this gap, Microsoft introduced the Anti-Malware Scan Interface (AMSI). AMSI is a versatile standard that allows applications and services to integrate directly with any anti-malware product present on the machine. Suddenly, script execution was no longer invisible.

Today, bypassing AMSI is a mandatory requirement for any Red Team engagement utilizing PowerShell or .NET payloads. In this post, we will explore how AMSI works and the advanced techniques used to blind it.

How AMSI Works

AMSI acts as a middleman. When you execute a PowerShell script, the PowerShell engine intercepts the script's contents after it has been de-obfuscated but before it is actually executed.

PowerShell passes this cleartext string to AMSI (specifically, the AmsiScanBuffer or AmsiScanString functions located inside amsi.dll). AMSI then forwards the buffer to the installed Antivirus (e.g., Windows Defender). The AV analyzes the string against its signature database and returns a result.

If the AV returns AMSI_RESULT_CLEAN, the script executes. If it returns AMSI_RESULT_DETECTED, execution is blocked, and a red error message is thrown to the console.

Technique 1: PowerShell Downgrade Attacks

The easiest way to bypass AMSI is to simply step back in time. AMSI was introduced in Windows 10 and is tied heavily to PowerShell version 5.0 and above.

Many modern Windows systems still have PowerShell Version 2.0 installed for legacy compatibility. PowerShell v2 has absolutely no concept of AMSI. An attacker can simply launch their shell by specifying the version:

powershell.exe -Version 2

Once dropped into the v2 prompt, the attacker can execute known malicious scripts (like Invoke-Mimikatz) with zero AMSI interference. To defend against this, organizations must explicitly uninstall PowerShell v2 from all endpoints.

Technique 2: Obfuscation and String Manipulation

Because AMSI scans the actual text of the script, early bypasses relied on simply splitting up the flagged strings so the AV signatures wouldn't trigger.

If the string Invoke-Mimikatz is flagged, an attacker can manipulate it in memory:

$part1 = "Invoke-Mimi"
$part2 = "katz"
Invoke-Expression ($part1 + $part2)

While this worked for years, modern AMSI is much smarter. It actively evaluates concatenated strings and uses machine learning models to detect script obfuscation itself as an indicator of compromise.

Technique 3: Memory Patching (The Ultimate Bypass)

The most sophisticated and reliable way to bypass AMSI is to kill the messenger. Since AMSI operates in the same user-mode memory space as the PowerShell process itself, the attacker has the same level of access to amsi.dll as the operating system does.

Using a technique known as Memory Patching, an attacker writes a short snippet of C# or PowerShell that interacts with the Windows API (via VirtualProtect). The script locates the exact memory address where the AmsiScanBuffer function lives inside amsi.dll.

Once found, the attacker overwrites the first few bytes of the function's assembly instructions with a RET (return) instruction, or forces it to permanently return the hex value for AMSI_RESULT_CLEAN.

After this patch is applied to the memory space, every subsequent script executed in that PowerShell session is routed to AmsiScanBuffer. The function instantly returns "Clean" without ever sending the payload to the Antivirus. AMSI is effectively lobotomized.

Defending Against AMSI Bypasses

Because memory patching occurs inside user-land memory, defending against it is incredibly difficult for traditional AV.

To detect these bypasses, mature Security Operations Centers rely on:

1. Script Block Logging (Event ID 4104): Even if AMSI is patched, PowerShell's internal logging might still capture the actual bypass script being executed.
2. API Monitoring via EDR: Modern EDR solutions heavily monitor calls to VirtualProtect and WriteProcessMemory. If a PowerShell process suddenly attempts to modify the executable memory region of amsi.dll, the EDR will kill the process and generate a critical alert.

Conclusion

The introduction of AMSI fundamentally changed offensive security, forcing attackers to abandon lazy scripts in favor of deep memory manipulation. Understanding how to patch amsi.dll is a rite of passage for modern Red Teamers, and detecting that manipulation remains a constant priority for Blue Teams.