/
githubmirror
/
PowerShell
Обзор
Документация
Войти
/
githubmirror
/
PowerShell
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
test/powershell/Modules/Microsoft.PowerShell.Security/AmsiInterface.Tests.ps1
35 строк
1 KB
Steve Lee
Update copyright notice to latest guidance (#12190)
24 мар 2020, 21:08
Не верифицирован
24 мар 2020, 21:08
b7cb335
Код
Авторство
О чём код?
# Copyright (c) Microsoft Corporation. # Licensed under the MIT License. try { $defaultParamValues = $PSDefaultParameterValues.Clone() $PSDefaultParameterValues["it:Skip"] = !$IsWindows Describe "AMSI scan should detect suspicious content" -Tags 'Feature','RequireAdminOnWindows' { BeforeAll { [System.Management.Automation.Internal.InternalTestHooks]::SetTestHook("UseDebugAmsiImplementation", $true) } AfterAll { [System.Management.Automation.Internal.InternalTestHooks]::SetTestHook("UseDebugAmsiImplementation", $false) } It "Verifies AMSI scan detects debug suspicious content" { $EICAR_STRING_B64 = "awZ8EmMWc3JjaAdvY2lrBgcbY20aBHBwGgROF3Z6cHJhHmBncn13cmF3HnJ9Z3plemFmYB5ndmBnHnV6f3YSF3sYexk= " $bytes = [System.Convert]::FromBase64String($EICAR_STRING_B64) $EICAR_STRING = -join ($bytes | ForEach-Object { [char]($_ -bxor 0x33) }) { Invoke-Expression -Command "echo '$EICAR_STRING'" } | Should -Throw -ErrorId "ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand" } } } finally { if ($defaultParamValues -ne $null) { $Global:PSDefaultParameterValues = $defaultParamValues } }