Introduction and Goals AMSI offers a fantastic interface for endpoint security vendors to gain insight into in-memory buffers from components that choose have their content scanned. Microsoft documents the following list of components that opt in to AMSI: User Account Control, or UAC (elevation of EXE, COM, MSI, or ActiveX installation) PowerShell (scripts…