What resulted is the Antimalware Scan Interface (AMSI).ĪMSI is undoubtedly one of the most significant improvements in endpoint security optics. This strategy was and remains effective, however, it poses an interoperability and maintenance burden subject to instability, concerted evasion by mature adversaries, and disapproval from operating system vendors.įortunately, Microsoft recognized the need to improve in-memory optics, while at the same time offering a stable interface for themselves and third party vendors to tap into.

Some vendors rose to the challenge by injecting code into processes and hooking functions commonly abused by attackers. Historically, AV engines and EDR products have engaged in an effective arms race against file-based malware but in-memory payloads have been a challenging blind spot. Take, for example, script and Office macro-based tradecraft. An Office document has a heavily obfuscated macro, and you spend hours trying to untangle how code was loaded.Īdversaries evolve by investing in tradecraft that abuses features that have little-to-no preventative controls or detection optics in place.A heavily obfuscated script executed, and it is a challenge to make any sense of what it’s actually doing.

A child process spawned from the WMI service wmiprvse.exe.

How did the script do it and what did it load? What exactly was downloaded and executed? The command and control (C2) URL is present but there is no execution context beyond that.

A PowerShell process downloaded and executed a payload in memory.

How do you make sense of the root cause of the suspicious behavior?

A process exhibits suspicious behavior but there are no relevant command-line artifacts.

Applocker