AMSI
noun · also Antimalware Scan Interface · Microsoft Learn: Antimalware Scan Interface
A Windows interface that lets applications such as PowerShell send scripts to the installed antivirus for scanning just before they run.
The Antimalware Scan Interface (AMSI) is a standard way for applications to ask the installed antimalware product, such as Microsoft Defender Antivirus, whether some content is malicious. PowerShell, Windows Script Host, VBA macros in Office and other script engines use it to submit code at the moment it is about to run.
That timing is what makes AMSI useful. Attackers often hide scripts with layers of encoding and obfuscation so that nothing suspicious is ever written to disk. By the time the script engine executes the code, those layers have been removed, so the antivirus sees the real content. Because AMSI is so effective, attackers try to disable or bypass it in memory, and those bypass attempts are themselves a strong detection signal.
Example
A user opens a document whose macro launches PowerShell with a Base64-encoded command. The command decodes a second script and runs it in memory. Before that inner script executes, PowerShell passes it through AMSI, Defender recognizes a known downloader, and the script is blocked.
Why it matters for a SOC analyst
AMSI detections often appear in alerts as script content that was blocked, which shows you the attacker's actual code instead of an encoded blob. An attempt to tamper with AMSI on a host is a sign of hands-on attacker activity and deserves a quick look.
Articles that use this term
Tutorials · · 4 min read
Hunting suspicious PowerShell with KQL in Defender XDR
Five advanced hunting queries that surface encoded commands, Office spawning PowerShell, download cradles and rare scripts, and how to triage each hit.
Related terms
- Fileless malware
Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.