Using AMSI integration to identify script-based attacks (F-Secure Windows)

Advanced malware uses scripts that are disguised or encrypted to avoid traditional methods of scanning. Such malware is often loaded directly into memory, so it does not use any files on the device.

AMSI is an interface that applications and services that are running on Windows can use to send scanning requests to the antimalware product installed on the computer. This provides additional protection against harmful software that uses scripts or macros on core Windows components, such as PowerShell and Office365, or other applications to evade detection.

To turn on AMSI integration in the product:

1. 1. Open F-Secure SAFE from the Windows Start menu.
   2. On the main view, select Viruses and Threats.
   3. On the Viruses and Threats view, select Settings.
   4. Select Edit settings.

      Note: You need administrative rights to change the settings.

   5. Turn on Antimalware Scan Interface (AMSI).

The product now notifies you of any harmful content that AMSI detects, and logs those detections in the event history.

Source : Official F-Secure Brand
Editor by : BEST Antivirus KBS Team