topic Re: AMSI Byte Array Scanning in Cortex XDR Discussions

AMSI Byte Array Scanning

JAEvans — Thu, 30 May 2024 19:51:25 GMT

Does anybody have a solution similar to Defender for Endpoint for using AMSI programmatically to scan incoming files? Essentially, we have a requirement to scan incoming files that are scanned prior to being sent along to their next hop. This all occurs in memory and never actually writes to the disk.

Re: AMSI Byte Array Scanning

JayGolf — Wed, 05 Jun 2024 07:36:29 GMT

Moving post to Cortex XDR for more visibility.

Re: AMSI Byte Array Scanning

aspatil — Thu, 06 Jun 2024 06:31:28 GMT

Hello @JAEvans ,

Cortex XDR being execution based detection we do collect AMSI content scan events and use it for detection purposes. You can use below example XQL query to fetch AMSI data.
preset = xdr_event_log
| filter lowercase(action_evtlog_description) contains "amsi"
| filter lowercase(action_evtlog_username) not contains "system"

If the malware plants in the memory and then executes which in turn comes to the surface, then the agent will prevent that attack

Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !