Antimalware Scan Interface

The Antimalware Scan Interface (AMSI) is a Windows API (Application Programming Interface) designed to enhance malware protection within Windows applications.

Key aspects of AMSI include:

• Functionality: AMSI allows for the enhancement of malware protection in Windows applications. It can integrate with compatible antimalware software installed on the system to boost detection capabilities, including signature- and reputation-based detection.
• Usage: Microsoft Defender for Endpoint, for example, utilizes AMSI to enhance protection against non-traditional cyber threats, such as fileless malware and script-based attacks.

Bypassing AMSI

AMSI is recognized as a security control that attackers try to evade when performing malicious activities. Attackers can bypass Windows AMSI by manipulating elements such as functions, internal files, or URLs.

Techniques used by adversaries to bypass AMSI detection include:

1. PowerShell Downgrade: Attackers may downgrade the PowerShell version to 2.0 to evade AMSI detection. This allows them to execute malicious commands, such as amsiutils, which AMSI would typically block.
2. Obfuscation: This technique involves making code unreadable and complex to bypass AMSI. Attackers break strings and concatenate them using the + operator. Tools like AmsiTrigger can be used to scan scripts against AMSI and identify which lines trigger detection for targeted obfuscation.
3. Forcing an error: This involves modifying the amsiInitFailed() function to return a value that generates an error during AMSI initialization. This manipulation allows attackers to bypass AMSI by allocating memory and modifying values within the AmsiUtils class.
4. Memory Hijacking: Attackers can manipulate AMSI's internal functions by hooking the AmsiScanBuffer() function, forcing it to always return AMSI_RESULT_CLEAN. The AMSI_RESULT_CLEAN result indicates that AMSI found no signs of malware, thus allowing the malicious code to proceed. This can be performed by downloading and loading a specific DLL file (e.g., ASBBypass.dll).