AMSI Basics

Basics of Antimalware Scan Interface (AMSI)

Introduction

When a process instantiates amsi.dll gets loaded into the process and following are the series of events which occurs during the life of process
​
AMSI Life Cycle
  • amsi.dll invokes AmsiInitialize function which basically create amsiContext (AmsiContext will be used in all upcoming api calls)
  • When a user enters a command and press enter, AmsiOpenSession will be called which accept the amsicontext and a pointer called amsiSession
    • amsiSession will be used throughout the analysis of that particular command
  • After creating the amsiSession, AmsiScanBuffer will be called with the arguments
AmsiScanBuffer
[Syntax]
HRESULT AmsiScanBuffer(
[in] HAMSICONTEXT amsiContext,
[in] PVOID buffer,
[in] ULONG length,
[in] LPCWSTR contentName,
[in, optional] HAMSISESSION amsiSession,
[out] AMSI_RESULT *result
);
[Explanation]
  • amsiContext: this is the context which is returned from AmsiInitialize function at the time of process creation.
  • Buffer: The buffer from which to read the data to be scanned.
  • Length: The length, in bytes, of the data to be read from buffer.
  • contentName: The filename, URL, unique script ID, or similar of the content being scanned
  • amsiSession: The HAMSISESSION handle provided by amsiOpenSession function.
  • Result: The result of the scan.
    • 1 = means no malicious activity detected
    • 32768 = means command is malicious
​