After disabling or enabling AMSI, you need to close all instances of that process and relaunch it to unload or load the DLL

Technical Articles ID: KB95181
Last Modified: 2022-05-04 04:59:07 Etc/GMT

Environment

Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
ENS Threat Prevention 10.x

Problem

Scripts might take longer to execute after you disable Antimalware Scan Interface (AMSI) in the ENS ATP and ENS Threat Prevention policy.

Example:

Without ENS, a query takes about seven seconds to execute.
With AMSI enabled in the ENS ATP or ENS Threat Prevention policy, the same query takes about 20 seconds to execute.
After you disable AMSI in the ENS ATP or ENS Threat Prevention policy, the same query takes about 15 seconds to execute.
After a reboot or process restart, the query times go back to seven seconds.

Cause

This behavior is expected. Even if ENS AMSI is disabled, the Microsoft amsi.dll hooks onto the application. Microsoft owns the AMSI framework. ENS follows the AMSI framework being loaded into any process requested for AMSI scanning through MfeAmsiProvider.dll or ATPAmsiGuard.dll. If ENS doesn't follow the AMSI framework guidelines by not injecting into a process when called on, there could be unknown ramifications on the system. Microsoft doesn't offer the ability to third-party vendors to exclude themselves from an AMSI requested injection. Because the process is still injected by MfeAmsiProvider.dll or ATPAmsiGuard.dll, you might see a performance impact.

Solution

After you disable AMSI, you need to close all instances of that process and relaunch it to unload MfeAmsiProvider.dll or ATPAmsiGuard.dll. You don't need to reboot unless the process in question can't be closed without a system reboot.

NOTE: As an example, where a process restart isn't possible (for example, Internet Information Services (IIS) service), you need to reboot the system to unload MfeAmsiProvider.dll or ATPAmsiGuard.dll.

To confirm the presence or absence of the ENS ATP or ENS Threat Prevention AMSI .dlls and the associated PID details, run the following command from an administrator command prompt:

For ENS ATP AMSI: tasklist /m atpamsiguard.dll
For ENS Threat Prevention AMSI: tasklist /m mfeamsiprovider.dll

To list processes with a Microsoft AMSI .dll loaded, run the following command:

tasklist /m amsi.dll

ENS AMSI is configured in the following policy locations:

ePolicy Orchestrator:
- ENS ATP: Policy Catalog, Endpoint Security Adaptive Threat Protection, Options, <policy name>, Enable enhanced script scanning (includes AMSI integration)
- ENS Threat Prevention: Policy Catalog, Endpoint Security Threat Prevention, On-Access Scan, <policy name>, Enable AMSI (provides enhanced script scanning)
MVISION Endpoint: Policy Catalog, MVISION Endpoint, General, <policy name>, Enable script scanning

Workaround

Create an on-access scan standard exclusion. For more information about ENS ATP AMSI exclusions, see the following:

"Exclude processes from Adaptive Threat Protection scanning" section of the Endpoint Security 10.7 Product Guide.
"Adaptive Threat Protection - Options" section of the Endpoint Security 10.7 Interface Reference Guide.

If this workaround doesn't resolve the issue, the only solution is to disable AMSI.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

After disabling or enabling AMSI, you need to close all instances of that process and relaunch it to unload or load the DLL

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

After disabling or enabling AMSI, you need to close all instances of that process and relaunch it to unload or load the DLL

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title