Malware within a zip file is not recognized by AMSI APIs about amsi HOT 3 CLOSED

This isn't directly answering the question, but may be useful; I have tested a similar situation where I embed an EICAR file inside a PDF. It's basically an attachment.
AMSI does find it, which means Windows Defender would have had to extract the attachments; PDF encodes the attachment so the EICAR byte sequence is not directly present in the PDF.

If I save that PDF file on disk, the Windows Defender on-access scanner will not find it - but if I run a full scan then Windows Defender does find it.

from amsi.

I can't directly answer this but I can share my experience.

I wrote an active malware scanning routine for my employer which is working absolutely fine when Windows Defender is in use. The EICAR sequence is found in any kind of file, even in ZIP files and in ZIP files inside ZIP files. It seems like it is working perfectly fine.
But since our Software is installed on our customers' systems, we have no idea what scanning solutions they use, so we tested a few of them to make sure it works for everyone. The results were shattering. No scanner software other than Windows Defender found the EICAR sequence except when it was directly scanned in a plain text format although when scanning the file directly in Windows, a threat was detected by the same virus scanner.

For me this leads to only one conclusion: No other scanner than Windows Defender is using AMSI correctly or to its full extent to call it a properly working solution for file scanning.

While searching for a better solution, I mostly read about AMSI to be used for scanning scripts and data that never reaches the disk drive but is kept in memory only. My personal opinion is that this should only be an additional feature, and file scanning should still work, but it seems it doesn't. Except with Windows Defender.

from amsi.

Thank-you for your detailed explanation.

I have the same experience that windows defender is properly identifying EICAR sequence, even it it inside the a zip file. So, We would also go with windows defender. Our plan is to use MpCmdRun.exe, a command line executable of windows defender for on-demand malware scanning.

As we decided to go with Windows Defender, i hope this issue can be closed.

from amsi.