pracsec / amsiscanner

A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.

AmsiScanner

Scan files with the Anti-Malware Scan Interface (AMSI) and minimize malicious text files and PowerShell scripts to see what the Antivirus is flagging as malicious.

Features:

• Scan binary and text files with the installed AV to see if they are malicious.
• Find the smallest subset of text that is still flagged as malicious by the installed AV.
• Find the smallest subset of PowerShell tokens that are still flagged as malicious by the installed AV.
• Encrypt files to mitigate accidental exection and detection by the installed AV.
• Read files encrypted with this utility.

Dependencies

• Windows 10+
• .NET 6.0

Documentation

View documentation here: https://practicalsecurityanalytics.com/home/tools/amsiscanner/