AMSI test sample execution

amsi_test_string

Passes Microsoft's published AMSI test sample string to PowerShell. A working Antimalware Scan Interface provider must refuse the script, so a clean run means script scanning is absent or bypassed.

Severity medium how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 1 Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1059.001	PowerShell	Execution	coverage statistics
T1562.001	Disable or Modify Tools	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other obfuscation and scripting tests

Other tests in the Obfuscation and scripting category.
Test	What it does	Severity
Character-obfuscated command execution cmd_obfuscated_exec	Executes a recon command hidden with caret escaping and environment-variable substitution on Windows, or quote splitting on macOS/Linux — the string-o…	medium
Download cradle pattern powershell_download_cradle	Uses the Net.WebClient download-cradle pattern (Windows) or a curl-into-shell pipeline (macOS/Linux) against a harmless connectivity endpoint. The fet…	medium
Base64-encoded PowerShell/shell execution powershell_encoded_command	Runs a base64-encoded command through powershell -EncodedCommand (Windows) or a base64 pipe into sh (macOS/Linux). The payload only prints a marker an…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.