Exploring the Antimalware Scan Interface (AMSI)
In the past, attackers often used scripts or executables to have their malware run on client systems. But antivirus products got better and better over the years, which meant that file-based malware could be more easily identified and removed.
For malware authors, this was a serious problem that they tried to circumvent, and so they came up with the solution to run their malicious code directly in memory, without touching the hard disk. So, specifically, built-in programs such as PowerShell, VBScript, JavaScript, and other tools are being used to run their malware attacks. Attackers became creative and obfuscated their code so that it’s not obviously identified as malware.
Microsoft came up with a solution to inspect the code before running it, called the Antimalware Scan Interface (AMSI). AMSI has developed accordingly and can even protect against the most obfuscated attacks. However, it’s a constant cat-and-mouse...
