ML Protect enhanced script scanning includes integration with Antimalware Scan Interface (AMSI) to provide protection against non-browser-based scripts, such as PowerShell, JavaScript, and VBScript.
AMSI is a generic interface standard provided by Microsoft and supported on Windows 10, Windows Server 2016, and Windows 2019 and Windows 2022 systems. It allows applications and services to integrate with Adaptive Threat Protection, providing better protection against malware.
Tip
For the best protection against script-based threats, enable enhanced script scanning with Threat Prevention AMSI and ScriptScan, which scans browser-based scripts.
Supported operating systems
With enhanced script scanning enabled, the operating system determines how this feature analyzes the script:
Windows 10, Windows Server 2016, and Windows Server 2019 — AMSI blocks the script before execution.
Actions and exclusions
Enhanced script scanning uses settings from both Adaptive Threat Protection and Threat Prevention.
To specify: | Location | Module | Notes |
|---|---|---|---|
Actions | Action Enforcement section in the Options settings | Adaptive Threat Protection | |
Exclusions | Standard process types in the Process Settings section in the On-Access Scan settings | Threat Prevention | Most files that are excluded from on-access scans are also excluded from enhanced script scanning. Some scripts, such as PowerShell, are fileless and are not excluded from enhanced script scanning. |
Enhanced script scanning workflow
.png)