SPE scripts are blocked by antivirus software

[michaellwest]

This issue was raised by a community member Paul de Ruiter.

The issue started with the following error message:

This code is executed when runspaces are created to load the aliases from old command name to new command name.

Exception: System.Management.Automation.ParseException
Message: At line:1 char:1
+ New-Alias Serialize-Item Export-Item -Description 'Serialize-Item->Ex ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
Source: System.Management.Automation
   at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
   at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
   at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
   at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
   at Cognifide.PowerShell.Core.Host.ScriptSession.ExecuteCommand(Boolean stringOutput, Boolean marshallResults)
   at Cognifide.PowerShell.Core.Host.ScriptSession.<>c__DisplayClass150_0.<ExecuteScriptPart>b__0()
   at Cognifide.PowerShell.Core.Utility.SpeTimer.Measure[T](String message, Boolean log, Func`1 action)
   at Cognifide.PowerShell.Core.Host.ScriptSession.ExecuteScriptPart(String script, Boolean stringOutput, Boolean internalScript, Boolean marshalResults)
   at Cognifide.PowerShell.Core.Host.ScriptSession.Initialize(Boolean reinitialize)
   at Cognifide.PowerShell.Core.Host.ScriptSession.Initialize()
   at Cognifide.PowerShell.Core.Host.ScriptSession..ctor(String applianceType, Boolean personalizedSettings)
   at Cognifide.PowerShell.Core.Host.ScriptSessionManager.GetSession(String persistentId, String applianceType, Boolean personalizedSettings)
   at Cognifide.PowerShell.Client.Applications.PowerShellRunner.Execute()
   at Cognifide.PowerShell.Client.Applications.PowerShellRunner.Execute(ClientPipelineArgs args)

This issue also resulted in the console to just hange:

[michaellwest]

The latest discovery is the following:

CrowdStrike Falcon Sensor was installed on the machine as a replacement for McAfee. CrowdStrike has an interface for ASMI. Once the interface was disabled the errors stopped and SPE worked as expected. Waiting to hear back if the Sitecore web root can be excluded in the scanning.

Some things we tried:

Running the function found in this article to disable the AMSI but it subsequently resulted in Windows Defender treating the dlls like it contained a Win32/AmsiTamper.B virus. Using this article helped to address the previous issue but is obviously not a viable long-term solution.

[michaellwest]

Another interesting point. The 4.8 version of .Net now includes the following behavior as shown by this statement.

Antimalware scanning for all assemblies.

In previous versions of the .NET Framework, the runtime scans all assemblies loaded from disk using either Windows Defender or third-party antimalware software. However, assemblies loaded from other sources, such as by the Assembly.Load(Byte[]) method, are not scanned and can potentially contain undetected malware. Starting with .NET Framework 4.8 running on Windows 10, the runtime triggers a scan by antimalware solutions that implement the Antimalware Scan Interface (AMSI).

[michaellwest]

Final update:

System administrators at our company have just modified policies in Crowdstrike to exclude Sitecore from being scanned for malware. This seems to work.

Success!

[mmacehardyman]

Hi @michaellwest ,

We are having this same issue and we didn't manage to solve it by excluding Sitecore (webroot) from being scanned.
We also have System administrators who need to make the necessary changes, but somehow they are not working.

Is it possible to get more details on the steps taken to solve it?

Thanks!

[michaellwest]

Hi @mmacehardyman I've not personally encountered the issue so I would not have much more detail than that which was shared by the community. Do you have any logs from the AV that tells you what is getting blocked? Perhaps a file path?

[mmacehardyman]

Hi @michaellwest ,

I asked the sysadmin for more information and this is what they gathered from the logs:

File Path: \Device\HarddiskVolume1\Windows\System32\inetsrv\w3wp.exe

This is what they have set (in GLOB format):

DETECT/BLOCK
• **\w3wp.exe

Also, this is what CrowdStrike thinks it is detecting:

Tactic & Technique: Execution via PowerShell
IOA name: PShellExploitKit2
IOA Description: A PowerShell script launched that shares characteristics with known PowerShell exploit kits. The script might connect to remote command and control. Decode and review the script.

Still no luck unfortunately, although I am getting tempted by the "solution" to bypass AMSI altogether ;-)

[mmacehardyman]

Hi @michaellwest ,

Wanted to let you know that we (the sysadmin) managed to fix it after all.
The solution was to create a IOA Exclusion (Indicator of Attack exclusion) for the exact detected exploit.

After that all was well again.

Thanks for chiming in.