Let's now take a look at AMSI.
AMSI is an interface,
which is leveraged by many of the built‑in scripting
languages available to us on Windows, such as PowerShell,
VBScript, JScript, and VBA.
By registering an AMSI provider,
an antivirus can scan scripts at runtime in an
attempt to block malicious activity.
Here is a simple example of how AMSI works.
When a PowerShell process is spawned and it starts executing code,
the code will be sent to the AMSI APIs exposed by the AMSI.dll module,
which is automatically loaded inside PowerShell processes.
The AMSI module will then forward the code which needs to be
scanned to the registered AMSI provider for analysis.
If malicious activity is detected by the AMSI provider,
the code will be blocked.
Let's now take a closer look at AMSI.
As explained, AMSI consists of several components.
One of those components is the AMSI.dll module,
which is automatically loaded into the process of applications,
which opt in to AMSI.
One example is PowerShell.
The AMSI.dll module exports multiple APIs,
which are called automatically when running PowerShell commands.
A good example is the AMSIScanBuffer API.
As its name suggests,
this API will scan a buffer containing code which is being
requested to run and returns a result once that buffer has
been analyzed by the antivirus.
To get more insight into how this works,
I have installed Frida, which is a tool which can be used to hook APIs.
I then proceeded to start up a command prompt,
which I will use to run Frida, and a PowerShell prompt,
which we will monitor with Frida.
We can hook into the relevant APIs using the following command and
specifying the process_id of our PowerShell process.
Each hooked API will result in a JavaScript file,
which contains a simple log function.
We can modify these JavaScript files to access input and output
parameters when the function is called and when it returns.
I have already prepared the code which will log the
parameters passed to the AMSIScanBuffer API,
as well as the results when the function returns.
If we now type a benign command in our PowerShell process,
we will notice that the value returned by the call
to the AMSIScanBuffer API is 1.
If we run another benign command, the value is also 1.
If, on the other hand, we run a command containing a known malicious string,
such as invoke‑mimikatz, the code is blocked,
and the result is not 1.
As you will see later on in the course,
AMSI is vulnerable to the same kind of tampering which can affect API
monitoring because it also occurs inside the process,
which can be tampered by the code running inside that process.