AMSI and ETW Tampering

• AMSI (Antimalware Scan Interface): Windows API that lets PowerShell, VBScript, JScript, Office macros, and .NET submit content to AV after deobfuscation, right before execution.
• AMSI is why fileless scripts still get caught — so attackers try to bypass it:
• Patch amsi.dll!AmsiScanBuffer in memory to return "clean."
• Corrupt amsiContext / force an error so scanning is skipped.
• Obfuscate strings so the scanned content looks benign.
• ETW (Event Tracing for Windows): the telemetry pipeline EDRs consume. Malware tampers with ETW (e.g. patch ntdll!EtwEventWrite) to go dark and blind the sensor.