Glossary
AMSI (Antimalware Scan Interface)
A Windows interface that lets antivirus scan script content at runtime, including PowerShell; attackers try to disable it in-process.
The Antimalware Scan Interface (AMSI) lets Windows Defender and other antivirus scan the content of scripts as they run, defeating simple obfuscation. PowerShell 5 on Windows 10 submits script blocks to AMSI before execution.
Because AMSI runs in the same process as the script, attackers try to neuter it — for example by setting the amsiInitFailed field so the process skips scanning, or patching AmsiScanBuffer in memory. Text that references AmsiUtils, amsiInitFailed or AmsiScanBuffer is a strong indicator of an AMSI bypass, which this parser flags. See decoding and findings.