search

cobbr / PSAmsi

PSAmsi is a tool for auditing and defeating AMSI signatures.
GNU General Public License v3.0
387 stars 71 forks source link

Defender prevents PSAmsi from working, so no malicious files can be scanned without powershell error message #8

Open LukeProducts opened 2 years ago

LukeProducts commented 2 years ago

Hello all,

I don't know if I understood the wiki correctly and am just missing an embarrassing error,

in any case I wanted to create true / false values, but when I try to scan a malicious file with PSamsi, only the red error message comes up in powershell that the file was blocked by my antivirus, but also PSAmsi's execution is terminated... So I can't get a true value for the scan anymore. If I disable defender I get false and a warning for each malicious file, but that is logical in this case.

Does anyone know what I am doing wrong?

With kind regards Luke