In-memory patching of AmsiScanBuffer/EtwEventWrite functions (Spark RAT)

Kaung Khant Ko@kaungkhantko

•updated Aug 28, 2026•1•0•2

This rule detects in-memory patching of critical Windows security functions, specifically AmsiScanBuffer (used by AMSI) and EtwEventWrite (used by ETW). It monitors for suspicious API calls such as VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory, or NtWriteVirtualMemory targeting these specific DLLs (amsi.dll and ntdll.dll), which is a common technique used by malware and offensive security tools to blind endpoint security and logging mechanisms.