AMSI

AMSI is a Windows interface that lets applications hand content to the installed antivirus for scanning at runtime, most importantly PowerShell and other script engines. It catches obfuscated or fileless scripts at the moment they are deobfuscated in memory, closing a gap that file-based scanning misses. Attackers respond with AMSI bypass techniques that patch the interface in memory, so detecting those bypass attempts has become part of endpoint defense.