You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello~!
For some purpose , I want to monitor powershell script when it's running.
According to the sourcecode from https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/runtime/CompiledScriptBlock.cs
I find the AMSI function will be called before compiling. So I make a test follow the instruction of AmsiProvider , But I can only see the function named CloseSession has been called , The scan function never have been called at all . The testing environment is Win10x86,16299,RS3
The text was updated successfully, but these errors were encountered:
Hello~!
For some purpose , I want to monitor powershell script when it's running.
According to the sourcecode from https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/runtime/CompiledScriptBlock.cs
I find the AMSI function will be called before compiling. So I make a test follow the instruction of AmsiProvider , But I can only see the function named CloseSession has been called , The scan function never have been called at all . The testing environment is Win10x86,16299,RS3
The text was updated successfully, but these errors were encountered: