Glossary
AMSI (Antimalware Scan Interface)
A Windows interface that lets scripting engines and applications send content to the installed antimalware product for scanning before it runs.
The Antimalware Scan Interface (AMSI) is a Windows API that lets applications pass content to the registered antimalware provider, such as Microsoft Defender, for scanning at run time. Its value is that it sees the code after de-obfuscation: PowerShell submits each script block just before execution, so content that was base64-encoded, downloaded into memory or assembled from strings is scanned in its final form. Windows Script Host (VBScript and JScript), Office VBA macros, Excel 4.0 macros, .NET in-memory assembly loading and User Account Control elevations are also integrated, and third-party applications can call the API.
AMSI is a central defense against fileless malware and malicious scripts. Attackers therefore try to bypass it, usually by patching AmsiScanBuffer in their own process or by downgrading to PowerShell 2.0, which has no AMSI support. Remove the PowerShell 2.0 feature, keep Defender's protection current, enable script block logging, which records the same de-obfuscated content, and alert on known bypass strings.
See Detecting malicious PowerShell and PowerShell logging and Constrained Language Mode.