Antimalware Scan Interface
To protect against malicious PowerShell scripts, Microsoft introduced the
Antimalware Scan Interface
to allow run-time inspection of all PowerShell commands or scripts.
At a high level, AMSI captures every PowerShell,
Jscript, VBScript, VBA, or .NET command or script at run-time
and passes it to the local antivirus software for inspection.
At the time of this writing, only 11 antivirus vendors currently support AMSI,
which means that the content passed by AMSI
is only analyzed if one of those antivirus products is installed.
More antivirus vendors will provide support over time, but it should be noted
that AMSI was first introduced in the release of Windows 10 in 2015
so the third-party adoption rate has not been impressive.