@@ -54,23 +54,31 @@ In this demonstration article, you have two engine choices to test AMSI:
54
54
Invoke-Expression $testString
55
55
```powershell
56
56
57
- 2 . On your device, open PowerShell as an administrator.
57
+ 1 . On your device, open PowerShell as an administrator.
58
58
59
- 3 . Type `Powershell -ExecutionPolicy Bypass AMSI_PoSh_script.ps1`, and then press **Enter**.
59
+ 1 . Type `Powershell -ExecutionPolicy Bypass AMSI_PoSh_script.ps1`, and then press **Enter**.
60
60
61
61
The result should be as follows:
62
62
63
- ```powershell
64
- Invoke-Expression : At line:1 char:1
65
- + AMSI Test Sample: 7e72c3ce-861b-4339-8740-8ac1484c1386
66
- + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
67
- This script contains malicious content and has been blocked by your antivirus software.
68
- At C:\Users\Admin\Desktop\AMSI_PoSh_script.ps1:3 char:1
69
- + Invoke-Expression $testString
70
- + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
71
- + CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
72
- + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand
73
- ```
63
+ ```powershell
64
+ Invoke-Expression : At line:1 char:1
65
+
66
+ + AMSI Test Sample: 7e72c3ce-861b-4339-8740-8ac1484c1386
67
+
68
+ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
69
+
70
+ This script contains malicious content and has been blocked by your antivirus software.
71
+
72
+ At C:\Users\Admin\Desktop\AMSI_PoSh_script.ps1:3 char:1
73
+
74
+ + Invoke-Expression $testString
75
+
76
+ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
77
+
78
+ + CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
79
+
80
+ + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand
81
+ ```
74
82
75
83
### Testing AMSI with VBScript
76
84
0 commit comments