AMSI demonstrations with Microsoft Defender for Endpoint

  • Article

Applies to:

Microsoft Defender for Endpoint utilizes the Antimalware Scan Interface (AMSI) to enhance protection against fileless malware, dynamic script-based attacks, and other nontraditional cyber threats. In this article, we describe how to test the AMSI engine with a benign sample.

Scenario requirements and setup

  • Windows 10 or newer
  • Windows Server 2016, or newer
  • Microsoft Defender Antivirus (as primary) and these capabilities need to be enabled:
    • Real-Time Protection (RTP)
    • Behavior Monitoring (BM)
    • Turn on script scanning

Testing AMSI with Defender for Endpoint

In this demonstration article, you have two engine choices to test AMSI:

  • PowerShell
  • VBScript

Test AMSI with PowerShell

  1. Save the following PowerShell script as AMSI_PoSh_script.ps1:

    Screenshot showing PowerShell script to save as AMSI_PoSh_script.ps1

  2. On your device, open PowerShell as an administrator.

  3. Type Powershell -ExecutionPolicy Bypass AMSI_PoSh_script.ps1, and then press Enter.

    The result should be as follows:

    Screenshot showing the results of the AMSI test sample. It should show a threat was detected.

Testing AMSI with VBScript

  1. Save the following VBScript as AMSI_vbscript.vbs:

    Screenshot showing VBScript to save as AMSI_vbscript.vbs

  2. On your Windows Device, open Command Prompt as an administrator.

  3. Type wscript AMSI_vbscript.js, and then press Enter.

    The result should be as follows:

    Screenshot showing the AMSI test results. It should show that antivirus software blocked the script.

Verifying the test results

In your protection history, you should be able to see the following information:

Screenshot showing the AMSI test results. The information should show that a threat was blocked and cleaned.

Get the list of Microsoft Defender Antivirus threats

You can view detected threats by using the Event log or PowerShell.

Use the Event log

  1. Go to Start, and search for EventVwr.msc. Open Event Viewer in the list of results.

  2. Go to Applications and Services Logs > Microsoft > Windows > Windows Defender operational events.

  3. Look for event ID 1116. You should see the following information:

    Screenshot showing Event ID 1116, which says malware or unwanted software was detected.

Use PowerShell

  1. On your device, open PowerShell.

  2. Type the following command: Get-MpThreat.

    You might see the following results:

    Screenshot showing the results of the Get-MpThreat command. It should show that an AMSI threat was detected.

See also

Microsoft Defender for Endpoint - demonstration scenarios

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.