Windows Antimalware Scan Interface - ASP.NET/IIS

Question

Has anybody had any experience of calling AMSI from ASP.NET? I have a web application that allows users to upload files, and we want to perform a virus scan on each file before we save it to the DB and make it downloadable to other users.

I have developed against Windows AMSI, and when running locally (IISExpress from VS) on my machine it works fine (my test case is that it rejects the EICAR test string in a text file).

However, when I build the application and put it onto our test server (running IIS 10) the test file is not being picked up as malware. I get all of the right return codes when initialising the interface, and scanning the file I get a valid result (of not detected).

Anybody got any ideas? I am running Windows 10 locally and the server is 2016. One thing I have noticed is that on the website it states [desktop apps only] next to supported server. Does this just mean no UWP? Or could it mean nothing running as a service either?

https://docs.microsoft.com/en-us/windows/win32/api/amsi/nf-amsi-amsiscanbuffer

Cheers, Andy

user_13114476 · Answer

I found the problem, after much headache. It appears that out of the box Windows Defender will automatically exclude the IIS process from malware checks. The effect of this is that the scan method doesn't reject malware.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus#opt-out-of-automatic-exclusions

The automatic exclusions can be turned off.

user_3331185 · Answer

I confirm that turning off automatic exclusions works. On Windows server 2016, using the local group policy editor, this causes AMSI to start working from IIS. On Windows 10, under Virus & threat protection, adding an exclusion for process w3wp.exe causes AMSI to stop working. So the exclusion is the culprit.

To me it is unclear why this is the behaviour. Windows Defender should not interfere with crucial parts of the operating system, at the risk of causing corruption. Having an exclude list of parts not to be scanned is understandable. So given the standard exclude list Defender will not scan the IIS process. However our route is in the opposite direction. In IIS we want to check a user upload for malware. IIS sends the payload to AMSI. AMSI sends the payload to Windows Defender. Defender should scan the payload for malware. Why does it decide: this is a request by IIS, no need to scan the payload, just return that the payload is clean? If anyone can explain this logic I would be very grateful.

We don't want to turn off automatic exclusions. This would put the production systems at risk. Exclusions are there for a reason.

We still want to use AMSI; we like the idea of a vendor agnostic interface to the locally installed virus product. We now consider the following workaround: from IIS launch a commandline exe that in turn talks to AMSI. Send the payload from IIS to the commandline process, probably using an anonymous pipe. The commandline forwards the payload to AMSI which forwards it to Windows Defender. Defender will scan the payload, as the name of the requesting process is that of the commandline and not w3wp.exe or another name in the exclusion list.

Not too happy with this approach, but it should work. We welcome suggestions for improvement.

Windows Antimalware Scan Interface - ASP.NET/IIS

2 Answers