Test PowerShell AMSI with Pester

1.6k views Asked by At

I'm writing a Pester test to verify the configuration of Windows computers. One of the tests I need is to verify whether PowerShell AMSI is working or not.

There is an AMSI test string that can be used to verify the function. I created the following test.

It '"Antimalware Scan Interface" is working' {
    # AMSI test string 'AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386'
    # (in the following as an obfuscated string)
    # must throw an error if executed (blocked by AMSI)
    $TestString = "FHJ+YHoTZ1ZARxNgUl5DX1YJEwRWBAFQAFBWHgsFAlEeBwAACh4LBAcDHgNSUAIHCwdQAgALBRQ="
    $Bytes = [Convert]::FromBase64String($TestString)
    $String = -join ($bytes | ForEach-Object { [char]($_ -bxor 0x33)})
    { Invoke-Expression -Command $String } | Should Throw
}

If I run the test, AMSI is working so well, that the complete Context block was not executed, i.e. the test was not executed and no success reported.

I receive "Error occurred in Context block" In Filename.Tests.ps1:420 Character:36 + Context 'Configure PowerShell' { + ~ The Script contains malicious data and was blocked by anti malware. (translated text. original might differ slightly.)

Instead the error, I want the Context executed and returned a "test successful" for throwing an error.

Any ideas how I could handle this issue or test AMSI otherwise?

0

There are 0 answers