1

I'm writing a Pester test to verify the configuration of Windows computers. One of the tests I need is to verify whether PowerShell AMSI is working or not.

There is an AMSI test string that can be used to verify the function. I created the following test.

It '"Antimalware Scan Interface" is working' {
    # AMSI test string 'AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386'
    # (in the following as an obfuscated string)
    # must throw an error if executed (blocked by AMSI)
    $TestString = "FHJ+YHoTZ1ZARxNgUl5DX1YJEwRWBAFQAFBWHgsFAlEeBwAACh4LBAcDHgNSUAIHCwdQAgALBRQ="
    $Bytes = [Convert]::FromBase64String($TestString)
    $String = -join ($bytes | ForEach-Object { [char]($_ -bxor 0x33)})
    { Invoke-Expression -Command $String } | Should Throw
}

If I run the test, AMSI is working so well, that the complete Context block was not executed, i.e. the test was not executed and no success reported.

I receive "Error occurred in Context block" In Filename.Tests.ps1:420 Character:36 + Context 'Configure PowerShell' { + ~ The Script contains malicious data and was blocked by anti malware. (translated text. original might differ slightly.)

Instead the error, I want the Context executed and returned a "test successful" for throwing an error.

Any ideas how I could handle this issue or test AMSI otherwise?

vrdse
  • 2,899
  • 10
  • 20
  • I'm not sure you're going to be able to work around this as AMSI is doing it's job. Out of curiosity does using `start-process` instead of invoke-expression help at all? – Mark Wragg Sep 08 '17 at 13:49
  • 1
    If you mean like `. powershell.exe -command $command` - it does not :/ – vrdse Sep 08 '17 at 13:54

0 Answers0