Notes on Defender's New AMSI Heuristics

Microsoft pushed an AMSI update on April 14. Three popular evasions stopped working overnight.

• Dead: classic amsi.dll unhook via VirtualProtect.
• Dead: hardware-breakpoint patches in PowerShell 5.x.
• Dead: AmsiScanBuffer return-value tampering with the old offset.
• Alive: indirect syscalls combined with a fresh offset.