The AMSI module does not block the script execution.
The block action may not work if the block setting in not correctly configured in policy with the appropriate confidence threshold level. For more information, see Configuring policy exclusions.
The AMSI module cannot detect a script execution that occurred before the AMSI module has been initialized and running.
Note
The AMSI module relies on security content to detect malicious activities. Make sure that the AMSI module is initialized and the content has been successfully downloaded. This information is available in the agentInfo audit in the sysInfo data.
The Trellix AMSI provider does not load in PowerShell, or any of the supported scripting engines.
This may occur when the Trellix Endpoint Security is installed side-by-side with other competing security solutions. Try to configure the other security products to trust or exclude Trellix binaries so that they can co-exist.
The AMSI module does not generate multiple alerts if I run a PowerShell script file on disk in a loop.
Most scripting engines implement performance optimization techniques to avoid scanning script contents repeatedly. In the case of PowerShell, the AMSI module only scans the content once unless the script file on the disk is modified, or a new instance of PowerShell is invoked,
Several AMSI providers are registered, but some scripts are scanned by only one provider.
When multiple AMSI providers are registered, the Microsoft AMSI framework decides which provider scans the script first. If an AMSI provider determines that a script is malicious, other providers may not get an opportunity to scan it.
The AMSI module database has grown beyond the defined limit in policy and filled the disk.
There is no combination of settings that will maintain the database size in all environments. For more information, see Managing disk space use and Policy recommendations for Windows servers with high workload systems.