Missing AMSI (fileless script) logging

[Gandalf098]

Some EDR vendors (namely Crowdstrike & Carbonblack), log ALL execution that passes through AMSI, this is especially useful for non-powershell scripts (such as VBA scripts or JScripts, there is a whole C2 Framework written around JScript (Kodiac), and these are definitely useful for detection of other techniques such as persistence, application locker (application whitelisting) bypass and others.

this is implemented through registering EDR AMSI DLL, and configuring it to generate a log each time it is called

it is also probably worth mentioning that while that is "bypassable", (if attacker bypasses AMSI altogether), however it provides detection opportunities and post-mortem RCA (root cause analysis) if it actually was bypassed.

[tsale]

Are you proposing a new category? If so, can you provide some examples from the EDRs you mentioned?