Further reading
If you want to explore some of the topics that were mentioned in this chapter, check out these resources:
- IAntimalwareProvider interface (amsi.h): https://learn.microsoft.com/en-us/windows/win32/api/amsi/nn-amsi-iantimalwareprovider
- AMSI for the developer audience, and sample code: https://learn.microsoft.com/en-us/windows/win32/amsi/dev-audience
- Better know a data source: Antimalware Scan Interface: https://redcanary.com/blog/amsi/
- Fileless threats: https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/fileless-threats
- Bypass AMSI by manual modification
Part 1: https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
- Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science: https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion...
