AmsiScannerLib 1.2.0

AmsiScannerLib

Version: 1.2.0 Target Framework: .NET 8.0 Author: Tapas Mahata / Nihilent Ltd License: MIT Repository: GitLab

Overview

AmsiScannerLib is an ASP.NET Core middleware library that integrates with Windows AMSI (Antimalware Scan Interface) to scan incoming HTTP requests for malicious content. It supports:

• JSON payload scanning
• Uploaded file scanning (including Base64-decoded content)
• Controller-level or action-level scanning toggle via [AmsiScan] attribute

By default, scanning is disabled and must be explicitly enabled on controllers or actions.

Features

• JSON payload scanning
• File scanning with Base64 support
• Controller or action level toggle using [AmsiScan]
• Default scanning is OFF (secure by default)
• Fully compatible with .NET 8
• Easy integration via middleware

Installation

.NET CLI

dotnet add package AmsiScannerLib --version 1.0.0

Package Manager

Install-Package AmsiScannerLib -Version 1.0.0

Usage

1. Register the middleware in Program.cs

builder.Services.AddSingleton<IAmsiScanner, AmsiScanner>();

var app = builder.Build();

app.UseRouting();
app.UseMiddleware<AmsiMiddleware>(); // AMSI scanning runs here
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();

2. Enable scanning via [AmsiScan] attribute

[ApiController]
[Route("api/[controller]")]
[AmsiScan] // Enables scanning for all actions
public class PayloadController : ControllerBase
{
    [HttpPost("check")]
    public IActionResult Check([FromBody] object data) => Ok("Scanned");

    [HttpPost("skip")]
    [AmsiScan(false)] // Disables scanning for this action
    public IActionResult Skip([FromBody] object data) => Ok("Skipped");
}

Behavior

• Middleware checks the [AmsiScan] attribute on controller and action.
• Action-level [AmsiScan(false)] overrides controller-level scanning.
• Scans JSON payloads and files; blocks malicious content with HTTP 400.
• If [AmsiScan] is missing, scanning is disabled by default.

Requirements

• .NET 8.0 or higher
• Windows OS with AMSI enabled

Notes

• Place app.UseMiddleware<AmsiMiddleware>() after app.UseRouting() to ensure endpoint metadata is available.
• JSON fields and uploaded files are scanned recursively.
• Works seamlessly in ASP.NET Core 8 applications.

License

MIT License. See LICENSE file for details.