Why AMSI? A practical example
Before we dive deeper into what exactly AMSI is, let’s first look at the why. As I mentioned in the introduction of this chapter, it’s an ongoing battle between attackers and defenders. Attackers try to launch successful attacks, while defenders try to prevent them.
In the early days, it was quite easy for attackers. Often, they just had to write a script to perform their malicious actions, but soon, defenders reacted to that so that their malicious intentions were detected and blocked. Attackers had to obfuscate their actions to launch successful attacks.
In order to analyze the content, antimalware vendors can create their own in-process COM server (DLL) that serves as an AMSI provider and register it under the following registry paths:
- HKLM\SOFTWARE\Microsoft\AMSI\Providers
- HKLM\SOFTWARE\Classes\CLSID
A vendor can register one or more AMSI provider DLLs.
When an application (such as PowerShell) submits content...
