Datto EDR now integrates with Windows Antimalware Scan Interface (AMSI) to expand visibility into script-based activity and improve detection coverage for fileless attacks. This helps you spot suspicious PowerShell and other scripting engine activity that can otherwise blend into normal admin work.
The Windows EDR agent adds AMSI detection components in a dedicated AMSI directory within the agent install path (including amsi.dll, keywords.enc, and damsi.sha). AMSI support is designed to inspect script content and alert on risky patterns, including interactive command activity and malicious keywords before execution.
