AMSI Basics

Basics of Antimalware Scan Interface (AMSI)

Introduction

When a process instantiates amsi.dll gets loaded into the process and following are the series of events which occurs during the life of process

AMSI Life Cycle

  • amsi.dll invokes AmsiInitialize function which basically create amsiContext (AmsiContext will be used in all upcoming api calls)

  • When a user enters a command and press enter, AmsiOpenSession will be called which accept the amsicontext and a pointer called amsiSession

    • amsiSession will be used throughout the analysis of that particular command

  • After creating the amsiSession, AmsiScanBuffer will be called with the arguments

AmsiScanBuffer

[Syntax]

HRESULT AmsiScanBuffer(
  [in]           HAMSICONTEXT amsiContext,
  [in]           PVOID        buffer,
  [in]           ULONG        length,
  [in]           LPCWSTR      contentName,
  [in, optional] HAMSISESSION amsiSession,
  [out]          AMSI_RESULT  *result
);

[Explanation]

  • amsiContext: this is the context which is returned from AmsiInitialize function at the time of process creation.

  • Buffer: The buffer from which to read the data to be scanned.

  • Length: The length, in bytes, of the data to be read from buffer.

  • contentName: The filename, URL, unique script ID, or similar of the content being scanned

  • amsiSession: The HAMSISESSION handle provided by amsiOpenSession function.

  • Result: The result of the scan.

    • 1 = means no malicious activity detected

    • 32768 = means command is malicious

Last updated