Skip to main content
Skip to main content
Microsoft Security
Sign in

Antimalware Scan Interface (AMSI)

Antimalware Scan Interface (AMSI)

Featured image for XLM + AMSI: New runtime defense against Excel 4.0 macro malware
• 9 min read

XLM + AMSI: New runtime defense against Excel 4.0 macro malware

We have recently expanded the integration of Antimalware Scan Interface (AMSI) with Office 365 to include the runtime scanning of Excel 4.0 (XLM) macros, to help antivirus solutions tackle the increase in attacks that use malicious XLM macros.
Read more XLM + AMSI: New runtime defense against Excel 4.0 macro malware
Featured image for Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning
• 6 min read

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

Microsoft Defender ATP leverages AMSI’s visibility into scripts and harnesses the power of machine learning to detect and stop post-exploitation activities that largely rely on scripts.
Read more Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning
Featured image for Dismantling a fileless campaign: Microsoft Defender ATP’s Antivirus exposes Astaroth attack
• 8 min read

Dismantling a fileless campaign: Microsoft Defender ATP’s Antivirus exposes Astaroth attack

Advanced technologies in Microsoft Defender ATP's Antivirus exposed and defeated a widespread fileless campaign that completely “lived off the land” throughout a complex attack chain that run the info-stealing backdoor Astaroth directly in memory
Read more Dismantling a fileless campaign: Microsoft Defender ATP’s Antivirus exposes Astaroth attack
Featured image for Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection
• 4 min read

Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection

While Windows Defender Antivirus makes catching 5 billion threats on devices every month look easy, multiple advanced detection and prevention technologies work under the hood to make this happen. Multiple next-generation protection engines to detect and stop a wide range of threats and attacker techniques at multiple points, providing industry-best detection and blocking capabilities.
Read more Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection
Windows Defender ATP Featured image for Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP
• 3 min read

Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP

In MITRE’s evaluation of endpoint detection and response solutions, Windows Defender Advanced Threat Protection demonstrated industry-leading optics and detection capabilities. The breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine learning, heuristics, and behavior monitoring delivered comprehensive coverage of attacker techniques across the entire attack chain.
Read more Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP
Featured image for Windows Defender ATP device risk score exposes new cyberattack, drives Conditional access to protect networks
• 5 min read

Windows Defender ATP device risk score exposes new cyberattack, drives Conditional access to protect networks

Several weeks ago, the Windows Defender Advanced Threat Protection (Windows Defender ATP) team uncovered a new cyberattack that targeted several high-profile organizations in the energy and food and beverage sectors in Asia.
Read more Windows Defender ATP device risk score exposes new cyberattack, drives Conditional access to protect networks
Taxonomy of fileless threats. Featured image for Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
• 16 min read

Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

Removing the need for files is the next progression of attacker techniques. While fileless techniques used to be employed almost exclusively in sophisticated cyberattacks, they are now becoming widespread in common malware, too.
Read more Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
Runtime scanning of macros via AMSI. Featured image for Office VBA + AMSI: Parting the veil on malicious macros
• 10 min read

Office VBA + AMSI: Parting the veil on malicious macros

As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behavior. Macro-based threats have always been a prevalent entry point for malware, but we…
Read more Office VBA + AMSI: Parting the veil on malicious macros
Featured image for Invisible resource thieves: The increasing threat of cryptocurrency miners
• 8 min read

Invisible resource thieves: The increasing threat of cryptocurrency miners

The surge in Bitcoin prices has driven widescale interest in cryptocurrencies. While the future of digital currencies is uncertain, they are shaking up the cybersecurity landscape as they continue to influence the intent and nature of attacks. Cybercriminals gave cryptocurrencies a bad name when ransomware started instructing victims to pay ransom in the form of…
Read more Invisible resource thieves: The increasing threat of cryptocurrency miners
Featured image for Windows Defender ATP machine learning and AMSI: Unearthing script-based attacks that ‘live off the land’
• 8 min read

Windows Defender ATP machine learning and AMSI: Unearthing script-based attacks that ‘live off the land’

Scripts are becoming the weapon of choice of sophisticated activity groups responsible for targeted attacks as well as malware authors who indiscriminately deploy commodity threats. Scripting engines such as JavaScript, VBScript, and PowerShell offer tremendous benefits to attackers. They run through legitimate processes and are perfect tools for “living off the land”—staying away from the…
Read more Windows Defender ATP machine learning and AMSI: Unearthing script-based attacks that ‘live off the land’