Antimalware Scan Interface (AMSI) - Win32 apps
By GrantMeStrength
Archived: 2026-04-05 13:26:53 UTC
Purpose
The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications
and services to integrate with any antimalware product that's present on a machine. AMSI provides enhanced
malware protection for your end-users and their data, applications, and workloads.
AMSI is agnostic of antimalware vendor; it's designed to allow for the most common malware scanning and
protection techniques provided by today's antimalware products that can be integrated into applications. It
supports a calling structure allowing for file and memory or stream scanning, content source URL/IP reputation
checks, and other techniques.
AMSI also supports the notion of a session so that antimalware vendors can correlate different scan requests. For
instance, the different fragments of a malicious payload can be associated to reach a more informed decision,
which would be much harder to reach just by looking at those fragments in isolation.
Windows components that integrate with AMSI
The AMSI feature is integrated into these components of Windows 10.
User Account Control, or UAC (elevation of EXE, COM, MSI, or ActiveX installation)
PowerShell (scripts, interactive use, and dynamic code evaluation)
Windows Script Host (wscript.exe and cscript.exe)
JavaScript and VBScript
Office VBA macros
Developer audience, and sample code
The Antimalware Scan Interface is designed for use by two groups of developers.
Application developers who want to make requests to antimalware products from within their apps.
Third-party creators of antimalware products who want their products to offer the best features to
applications.
For more information, see Developer audience, and sample code.
Note
In Windows 10, version 1903 and later, if your AMSI provider DLL is not Authenticode-signed, then it may not be
loaded (depending on how the host machine is configured). For full details, see IAntimalwareProvider interface.
https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
Page 1 of 2

In this section
The following topics provide information about AMSI and how to use it in your applications:
Related content
IAntimalwareProvider interface
Source: https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
Page 2 of 2