subat0mik/whoamsi

An effort to track security vendors' use of Microsoft's Antimalware Scan Interface

whoamsi's Issues

SentinelOne AMSI

SentinelOne supports AMSI but their docs are not publicly accessible.
https://support.sentinelone.com/hc/en-us/articles/1500005256241-How-the-SentinelOne-Agent-uses-Microsoft-AMSI-for-Detection

Support was added in the 4.4 Windows Agent, which had a general availability build 4.4 GA (4.4.3.149) - 14 October, 2020

Quotes from Docs:
Microsoft’s Antimalware Scan Interface is an API that applications and services use to send script content found in memory to registered AMSI handlers, like SentinelOne. The SentinelOne Agent gets the script content and provides users visibility on the content of scripts found on their endpoints. SentinelOne also uses AMSI for detection purposes.

On Windows 10 RS3+ endpoints, any process that calls the AMSI API to scan its content for malicious scripts loads and invokes the SentinelOne AMSI DLL file (SentinelAmsi64.dll or SentinelAmsi32.dll, depending on the process bit-architecture).

If the process is PowerShell, the Agent looks at the script to see if it is obfuscated, and sends the results to Deep Visibility.

Excluding a process does not stop the Agent from loading the SentinelOne AMSI DLL file, but it will stop the Agent from sending the script data to Deep Visibility.

Due to Microsoft API implementation, loading of SentinelOne AMSI DLL can either be enabled to all processes or fully disabled.

To disable the load of the SentinelOne AMSI DLL, add this Policy Override:

{
  "amsiConfig": {
    "registerAsAmsiProvider": false,
    "registerAsIoavProvider": false
  }
}

Sophos AMSI support

Hi,
Just a small issue for an update because of the récent Sophos implementation of AMSI since august 2020 for versions/products:
Central Server Core Agent 2.6.0,
Central Windows Core Agent 2.6.0

Infos:
https://support.sophos.com/support/s/article/KB-000039096?language=en_US

Thanks for maintaining this awesome resource!
kmkz

CrowdStrike Falcon supports AMSI

See https://www.reddit.com/r/crowdstrike/comments/gw9hqt/antimalware_scan_interface_amsi/fstsw3m?utm_source=share&utm_medium=web2x&context=3

Symantec AMSI evidence page is 404'd, new one is from Broadcom

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/release-notes/Whats-new-for-Symantec-Endpoint-Protection-14_3-.html

I don't think I can PR wiki changes.