Further reading

If you want to explore some of the topics that were mentioned in this chapter, check out these resources:

• IAntimalwareProvider interface (amsi.h): https://learn.microsoft.com/en-us/windows/win32/api/amsi/nn-amsi-iantimalwareprovider
• AMSI for the developer audience, and sample code: https://learn.microsoft.com/en-us/windows/win32/amsi/dev-audience
• Better know a data source: Antimalware Scan Interface: https://redcanary.com/blog/amsi/
• Fileless threats: https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/fileless-threats
• Bypass AMSI by manual modification

Part 1: https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/

Part 2: https://s3cur3th1ssh1t.github.io/Bypass-AMSI-by-manual-modification-part-II/

• Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science: https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion...