BREAKING AMSI: HOW MALWARE AVOIDS WINDOWS SCRIPT SCANNING

Summary from the TLDR InfoSec newsletter

AMSI is a Windows component that serves as a middleman to pass consumer content to a security solution such as Crowstrike or Microsoft Defender. The first method that is discussed in the post is to patch the prologue of the security provider's DLL to disrupt AMSI initialization. The second method is to intercept the AMSCI scan process by looping through the list of scan functions provided by the providers in CAmsiAntimalware and patching their scan functions to return immediately.