> For the complete documentation index, see [llms.txt](https://oklencodes.gitbook.io/untitled/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oklencodes.gitbook.io/untitled/offensive-security/runtime-detection-evasion/amsi-overview.md).

# AMSI Overview

AMSI (**A**nti-**M**alware **S**can **I**nterface) is a PowerShell security feature that will allow any applications or services to integrate directly into anti-malware products. Defender instruments AMSI to scan payloads and scripts before execution inside the .NET runtime. From Microsoft: "The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any anti-malware product that's present on a machine. AMSI provides enhanced malware protection for your end-users and their data, applications, and workloads."

For more information about AMSI, check out the [Windows docs](https://docs.microsoft.com/en-us/windows/win32/amsi/).

AMSI will determine its actions from a response code as a result of monitoring and scanning. Below is a list of possible response codes,

AMSI\_RESULT\_CLEAN = 0

* AMSI\_RESULT\_NOT\_DETECTED = 1
* AMSI\_RESULT\_BLOCKED\_BY\_ADMIN\_START = 16384
* AMSI\_RESULT\_BLOCKED\_BY\_ADMIN\_END = 20479
* AMSI\_RESULT\_DETECTED = 32768<br>

These response codes will only be reported on the backend of AMSI or through third-party implementation. If AMSI detects a malicious result, it will halt execution and send the below error message.

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FCQ1rFWgLDfygCnirEmnD%2FImage%201.PNG?alt=media\&token=087486f8-a80d-4a42-8913-ee42d96c2ea5)

AMSI is fully integrated into the following Windows components,

* User Account Control, or UAC
* PowerShell
* Windows Script Host (wscript and cscript)
* JavaScript and VBScript
* Office VBA macros

As attackers, when targeting the above components, we will need to be mindful of AMSI and its implementations when executing code or abusing components.