Antimalware Scan Interface (AMSI) Archives - ThreatsHub Cybersecurity News

XLM + AMSI: New runtime defense against Excel 4.0 macro malware

March 3, 2021 TH Author Antimalware Scan Interface (AMSI), Cybersecurity, Excel 4.0, macro malware, Microsoft security intelligence, Threat protection, XLM

We have recently expanded the integration of Antimalware Scan Interface (AMSI) with Office 365 to include the runtime scanning of Excel 4.0 (XLM) macros, to help antivirus solutions tackle the increase in attacks that use malicious XLM macros.
The post XLM + AMSI: New runtime defense against Excel 4.0 macro malware appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning

August 27, 2020 TH Author Active Directory attacks, Antimalware Scan Interface (AMSI), behavioral blocking and containment, BloodHound, Cybersecurity, Endpoint security, Kerberoasting, machine learning, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft security intelligence, post-exploitation, Threat protection

Microsoft Defender ATP leverages AMSI’s visibility into scripts and harnesses the power of machine learning to detect and stop post-exploitation activities that largely rely on scripts.
The post Stopping Active Directory attacks and other post-exploitation behavior with AMSI and machine learning appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Dismantling a fileless campaign: Microsoft Defender ATP next-gen protection exposes Astaroth attack

July 8, 2019 TH Author AI and machine learning, Antimalware Scan Interface (AMSI), Astaroth, behavior monitoring, Command-line scanning, Cybersecurity, Endpoint security, Execution stage, fileless, fileless malware, heuristics, Initial access stage, living-off-the-land, Microsoft Defender ATP, Security Intelligence, Threat protection, Windows Defender Antivirus, Windows Security, WMIC

Advanced technologies in Microsoft Defender ATP next-generation protection exposed and defeated a widespread fileless campaign that completely “lived off the land” throughout a complex attack chain that run the info-stealing backdoor Astaroth directly in memory
The post Dismantling a fileless campaign: Microsoft Defender ATP next-gen protection exposes Astaroth attack appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection

June 24, 2019 TH Author AI and machine learning, Antimalware Scan Interface (AMSI), behavior monitoring, behavior-based machine learning, Cybersecurity, Endpoint security, heuristics, machine learning, memory scanning, Microsoft Defender ATP, next-generation protections, Threat protection, Windows Defender Antivirus, Windows Security

While Windows Defender Antivirus makes catching 5 billion threats on devices every month look easy, multiple advanced detection and prevention technologies work under the hood to make this happen. Multiple next-generation protection engines to detect and stop a wide range of threats and attacker techniques at multiple points, providing industry-best detection and blocking capabilities.
The post Inside out: Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

September 27, 2018 TH Author Antimalware Scan Interface (AMSI), behavior monitoring, Cybersecurity, fileless malware, Windows 10, Windows 10 in S mode, Windows Defender Antivirus, Windows Defender ATP, Windows Defender AV

Removing the need for files is the next progression of attacker techniques. While fileless techniques used to be employed almost exclusively in sophisticated cyberattacks, they are now becoming widespread in common malware, too.
The post Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV appeared first on Microsoft Secure. READ MORE HERE…

Microsoft Secure

Office VBA + AMSI: Parting the veil on malicious macros

September 12, 2018 TH Author Antimalware Scan Interface (AMSI), Cybersecurity, macro malware, Macros, obfuscation, Office 365, Office 365 ATP, VBA, Windows, Windows 10, Windows Defender Antivirus, Windows Defender ATP, Windows Defender AV

As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behavior. Macro-based threats have always been a prevalent entry point for malware, but we
Read more
The post Office VBA + AMSI: Parting the veil on malicious macros appeared first on Microsoft Secure. READ MORE HERE…