Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 837024" data-attributes="member: 32260">Some people would like to test if AMSI works on their computer. It is easy when using the test script prepared by Microsoft:First copy/paste the below script to PowerShell console to see what command will be executed:[CODE]# AMSI test script$base64 = &quot;FHJ+YHoTZ1ZARxNgUl5DX1YJEwRWBAFQAFBWHgsFAlEeBwAACh4LBAcDHgNSUAIHCwdQAgALBRQ=&quot;$bytes = [Convert]::FromBase64String($base64)$string = -join ($bytes | % { [char] ($_ -bxor 0x33) })# The variable $string contains the command that will be executed$string[/CODE]You will see the output:&#039;AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386&#039;which is a decoded command.After this execute this command:[CODE]iex $string[/CODE]which should be blocked by WD:[ATTACH=full]225983[/ATTACH]Edit.Converting from BASE64 is blocked in PowerShell Constrained Language mode, which is set by SRP default-deny, or can be set via SysHardener.</blockquote>

[QUOTE="Andy Ful, post: 837024, member: 32260"] Some people would like to test if AMSI works on their computer. It is easy when using the test script prepared by Microsoft: First copy/paste the below script to PowerShell console to see what command will be executed: [CODE]# AMSI test script $base64 = "FHJ+YHoTZ1ZARxNgUl5DX1YJEwRWBAFQAFBWHgsFAlEeBwAACh4LBAcDHgNSUAIHCwdQAgALBRQ=" $bytes = [Convert]::FromBase64String($base64) $string = -join ($bytes | % { [char] ($_ -bxor 0x33) }) # The variable $string contains the command that will be executed $string[/CODE] You will see the output: 'AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386' which is a decoded command. After this execute this command: [CODE]iex $string[/CODE] which should be blocked by WD: [ATTACH type="full" alt="AMSI_test.png"]225983[/ATTACH] Edit. Converting from BASE64 is blocked in PowerShell Constrained Language mode, which is set by SRP default-deny, or can be set via SysHardener. [/QUOTE]

Verification