Week of June 2, 2025

A security researcher published a proof-of-concept technique to bypass the Windows Antimalware Scan Interface (AMSI) by setting hardware breakpoints on the AmsiScanBuffer function. The method manipulates memory to prevent AMSI from scanning malicious content, though it is limited by the number of available hardware breakpoints and may be unstable across platforms. This technique highlights a potential evasion method that could be used to circumvent endpoint detection mechanisms.

Security researchers Itay Yashar and Omer Golan published a proof-of-concept technique that prevents the Windows Antimalware Scan Interface (AMSI) DLL from loading into a process, effectively bypassing AMSI-based detection without traditional patching or unhooking. The method leverages Windows process mitigation policies to block amsi.dll loading, achieving stealthy evasion of endpoint security products that rely on AMSI for script and in-memory threat detection.

Security researchers document a technique combining encrypted syscall execution, call stack spoofing, hardware breakpoint clearing, and ETW patching to evade EDR and Sysmon. The method dynamically resolves syscall numbers, encrypts stubs with XOR, and patches NtTraceEvent to disable logging. This represents an evolution in adversary evasion capabilities.