Introduction In the previous Blog we dove into the working and functionalities of AMSI. We understood how AMSI is loaded into a PowerShell session and how a session is created accordingly. In this blog we will take a deeper look at the AMSI functions that we discussed in the previous blog and try to find out how and where we can implement our bypasses Inspecting AMSI functions AmsiScanBuffer We will first be looking into the AmsiScanBuffer function.