Glossary
AMSI (Antimalware Scan Interface)
A Windows interface that lets antivirus scan script content at runtime, including PowerShell; attackers try to disable it in-process.
The Antimalware Scan Interface (AMSI) is a Windows interface that lets Windows Defender and other antivirus products scan the content of scripts as they run, rather than only files on disk. PowerShell 5 on Windows 10 submits script blocks to AMSI before execution, so code that was Base64-encoded, compressed or assembled from fragments is scanned in its final, readable form. That defeats most simple obfuscation.
Why it matters in investigations
Because AMSI is loaded into the same process as the script (through amsi.dll), the script can try to switch it off for itself. Well-known techniques set the private amsiInitFailed field so the session believes AMSI failed to start and skips scanning, or patch AmsiScanBuffer in memory so every scan returns clean. An AMSI bypass is rarely an end in itself: it is the step just before a payload the attacker expects antivirus to catch.
Text that references AmsiUtils, amsiInitFailed, AmsiScanBuffer, AmsiOpenSession or amsi.dll is a strong indicator, and the bypass line itself is often recorded, because it has to be compiled like any other script block before it can take effect.
Example
A classic one-line bypass, as it might appear in a 4104 event or in a history file:
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
Attackers usually hide these names behind concatenation, [char] codes or Base64, so the parser searches each de-obfuscation layer it can decode, not just the raw text, and raises a high-severity AMSI bypass finding wherever one of the names appears.
Related terms
- PowerShell downgrade attack, another way to run without AMSI
- Script Block Logging, which often records the bypass itself
- Encoded command and download cradle, which frequently follow a bypass
Check your own evidence for AMSI tampering in the PowerShell Parser, and see decoding encoded commands and obfuscation for how the layers are unwound.