Posted on June 3, 2021 at 8:15 PM

Hackers Are Bypassing Microsoft’s AMSI Anti-malware Scanner

Researchers have discovered the most popular hacking tactics employed by threat actors to circumvent Microsoft’s Antimalware Scan Interface (AMSI) security tool.

The tool offers more security to systems as it is designed to integrate into anti-malware products.

The finding was prepared by the Sophos researchers and offers a detailed report about the threat actors’ new hacking strategy on AMSI. According to the report, the tactic includes uploading malicious files, steganography, and obfuscation of attacks.

Developed in 2015, AMSI provides software that communicates to security devices for streaming, memory scanning, and file sharing in a supplier-agnostic way for dangerous payloads.

The software was upgraded recently with the integration of Excel 4.0 (XLM) macro scanning to provide more security against the increased level of malicious tools on systems.

Sophos researchers stated that the threat actors try several things to make sure they deactivate or circumvent AMSI.

The possibility of the bypass of AMSI security protocol was stressed by security expert Matt Graeber in 2016. He stated that a single line of code was interchanged with the PowerShell feature for AMSI integration. As a result, the PowerShell-based process may have been halted theoretically.

Malicious is taking inspiration from the one-line AMZI bypass to develop malware that can circumvent the security software. They have employed several techniques to try and bypass signature-based scans.

Hackers altered the AMSI library

The researchers noted that most of the malware variations seem to be based on post-exploitation activities, such as lateral movement. One of the methods discovered tries to copy a PowerShell backdoor in a private IP address space from a web server.

A similar bypass was also discovered in another incident connected to attacks on Proxy Logon, where the threat actor duplicated the connection to a remote server to retrieve a PowerShell-based malware downloader.

The threat actors also use another tactic for the AMSI bypass. They use an offensive security tool called a Seatbelt. A delegate process was created using a PowerShell script using reflection to gain access to the .NET framework for AmsiUtils.

The Sophos researchers have also noted that about 98% of the AMSI bypass was carried out by altering the AMSI library. Different malware strains will try to overwrite instructions in the AmsiScanBuffer to ensure that the scan request fails.

Other varieties may try to alter the memory component that stores the code, which returns the buffer scan results and prompts failure.

Hackers are creating fake DLLs to bypass AMSI

The researchers have also identified other tactics used by the hackers to circumvent AMSI. These include Dumbgrading scripts engines, command-line remote scripts, and cobalt strike. For the cobalt strike technique, the hackers include the memory patch under amsi-disable, and become visible by the Agent Tesla Trojan family.

Under the remote script tactic, the hackers create fake DLLs which confuse PowerShell to load a fake version of amsi.DLL. This is an old strategy that is gradually fading because of the improved security levels Microsoft has put in place.

The Cobalt strike is also a memory patch tactic that comes with a PowerShell invoked remote script. The hacker can fabricate DLLs to load a fake ANSI version from the PowerShell. This method has also been existing for some years Presently, it’s extremely difficult to load unapproved engines, which is credited to Microsoft’s improved security too.

Hackers are using several tactics to bypass AMSI

Sophos says AMSI is playing a very important role to keep Windows 10 systems safe, considering how common the strategies have become in ransomware operations.

However, the researchers pointed out that AMSI isn’t a complete shield or total solution to security issues. That’s because threat actors targeting AMSI have increased in number and their activities. They are seriously working hard to make sure they circumvent the security check to get access to the system.