topic Windows Anti-Malware Scan Interface (AMSI) and Cortex XDR in Cortex XDR Discussions

Windows Anti-Malware Scan Interface (AMSI) and Cortex XDR

CraigV123 — Wed, 25 Oct 2023 15:24:14 GMT

Hey community,

I'm curious if anyone's had experience with integrating AMSI with Sharepoint servers and how Cortex XDR works into all of that. I am curious also, if AMSI needs to be enabled or if it's recommended to be disabled. Any current configuration documentation I find references Microsoft Defender and we've disabled that running XDR alone.

Configure AMSI integration with SharePoint Server - SharePoint Server | Microsoft Learn

I have a support case open for the same question but wanted to reach out here as well.

Thanks everyone!

Re: Windows Anti-Malware Scan Interface (AMSI) and Cortex XDR

nsinghvirk — Fri, 27 Oct 2023 16:04:41 GMT

Hello @CraigV123

Thanks for reaching out on LiveCommunity!

I do not have experience for AMSI integration with Sharepoint. But XDR do collect AMSI content scan events and use it for detection purposes. You can use below example XQL query to fetch AMSI data.

preset = xdr_event_log
| filter lowercase(action_evtlog_description) contains "amsi"
| filter lowercase(action_evtlog_username) not contains "system"

Similarly we also use Scriptblock logging to deobfuscate powershell scripts. Please refer to below video on this topic.

https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-script-block-query-and-bioc/ta-p/510469

We do not recommend to disable AMSI. Please let us know if you have additional questions.

Re: Windows Anti-Malware Scan Interface (AMSI) and Cortex XDR

Rocky-25 — Fri, 16 Feb 2024 08:03:50 GMT

Hi @CraigV123

We're facing the same challenge. The integration of the AMSI SharePoint feature with Cortex XDR seems not to work.

How did you deal with it? Do you enable or disable the feature?

As I understand it, Cortex only collects AMSI events that are related to a script engine like PowerShell.

Best Regards

Re: Windows Anti-Malware Scan Interface (AMSI) and Cortex XDR

CraigV123 — Fri, 16 Feb 2024 12:32:32 GMT

Hey Rocky,

For the time being, we actually did leave it disabled. We also only had the Prevent license model of XDR at the time and since upgraded to Pro so there's a lot more visibility into the SharePoint environment if something nefarious does happen. I reached out to Microsoft also, without high expectations, and did not receive a lot of help from them either.

XDR Pro, coupled with our other defense layers, provide good insight to those hosts.

Hope this helps!