Reply to thread

Message

<blockquote data-quote="notabot" data-source="post: 841303" data-attributes="member: 75970">Thank you very much for this Fabian, both for the detailed response on how AMSI works, it makes sense. While it&#039;s clear form what you said that up to the interpreter to support AMSI, &quot;Python&#039;s implementation is responsible to show us the code it is about to execute before it executes it&quot;when the interpreter shows the code to the AMSI module, the AMSI module needs to understand the code, to determine if it malicious or not (?) in that sense the module needs to be able to understand the language.&nbsp;Eg if I make my own simple scripting language and somehow make the interpreter work with AMSI, the AMSI module would not be able to decide if it is malicious or not (?) because it would not be able to even parse the code.&nbsp;If the above is correct (?) which scripting languages does the Emsisoft&#039;s AMSI module support ( provided that their interpreters/runtimes do make use of AMSI ).&nbsp;Understood what&#039;s the issue with behavioral blocking &amp; browsers as well, then only isolation is a viable option, it&#039;s a shame out-of the box containerisation does not currently exist on Windows, something like snap apps would had been almost ideal for generic browsing (though with WSL2, running actual snap apps should be doable).</blockquote>

[QUOTE="notabot, post: 841303, member: 75970"] Thank you very much for this Fabian, both for the detailed response on how AMSI works, it makes sense. While it's clear form what you said that up to the interpreter to support AMSI, "Python's implementation is responsible to show us the code it is about to execute before it executes it" when the interpreter shows the code to the AMSI module, the AMSI module needs to understand the code, to determine if it malicious or not (?) in that sense the module needs to be able to understand the language. Eg if I make my own simple scripting language and somehow make the interpreter work with AMSI, the AMSI module would not be able to decide if it is malicious or not (?) because it would not be able to even parse the code. If the above is correct (?) which scripting languages does the Emsisoft's AMSI module support ( provided that their interpreters/runtimes do make use of AMSI ). Understood what's the issue with behavioral blocking & browsers as well, then only isolation is a viable option, it's a shame out-of the box containerisation does not currently exist on Windows, something like snap apps would had been almost ideal for generic browsing (though with WSL2, running actual snap apps should be doable). [/QUOTE]

Verification