Skip to content

Commit 39bcdd5

Browse files
committed
fix spacing on code snippet
1 parent 662f26a commit 39bcdd5

File tree

1 file changed

+21
-13
lines changed

1 file changed

+21
-13
lines changed

defender-endpoint/mde-demonstration-amsi.md

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -54,23 +54,31 @@ In this demonstration article, you have two engine choices to test AMSI:
5454
Invoke-Expression $testString
5555
```powershell
5656
57-
2. On your device, open PowerShell as an administrator.
57+
1. On your device, open PowerShell as an administrator.
5858
59-
3. Type `Powershell -ExecutionPolicy Bypass AMSI_PoSh_script.ps1`, and then press **Enter**.
59+
1. Type `Powershell -ExecutionPolicy Bypass AMSI_PoSh_script.ps1`, and then press **Enter**.
6060
6161
The result should be as follows:
6262
63-
```powershell
64-
Invoke-Expression : At line:1 char:1
65-
+ AMSI Test Sample: 7e72c3ce-861b-4339-8740-8ac1484c1386
66-
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
67-
This script contains malicious content and has been blocked by your antivirus software.
68-
At C:\Users\Admin\Desktop\AMSI_PoSh_script.ps1:3 char:1
69-
+ Invoke-Expression $testString
70-
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
71-
+ CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
72-
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand
73-
```
63+
```powershell
64+
Invoke-Expression : At line:1 char:1
65+
66+
+ AMSI Test Sample: 7e72c3ce-861b-4339-8740-8ac1484c1386
67+
68+
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
69+
70+
This script contains malicious content and has been blocked by your antivirus software.
71+
72+
At C:\Users\Admin\Desktop\AMSI_PoSh_script.ps1:3 char:1
73+
74+
+ Invoke-Expression $testString
75+
76+
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
77+
78+
+ CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
79+
80+
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand
81+
```
7482
7583
### Testing AMSI with VBScript
7684

0 commit comments

Comments
 (0)