"Fossies" - the Fresh Open Source Software Archive

Member "PowerShell-7.2.5/test/powershell/Modules/Microsoft.PowerShell.Security/AmsiInterface.Tests.ps1" (21 Jun 2022, 1295 Bytes) of package /linux/misc/PowerShell-7.2.5.tar.gz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) Microsoft PowerShell source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file.

    1 # Copyright (c) Microsoft Corporation.
    2 # Licensed under the MIT License.
    3 
    4 try
    5 {
    6     $defaultParamValues = $PSDefaultParameterValues.Clone()
    7     $PSDefaultParameterValues["it:Skip"] = !$IsWindows
    8 
    9     Describe "AMSI scan should detect suspicious content" -Tags 'Feature','RequireAdminOnWindows' {
   10 
   11         BeforeAll {
   12             [System.Management.Automation.Internal.InternalTestHooks]::SetTestHook("UseDebugAmsiImplementation", $true)
   13         }
   14 
   15         AfterAll {
   16             [System.Management.Automation.Internal.InternalTestHooks]::SetTestHook("UseDebugAmsiImplementation", $false)
   17         }
   18 
   19         It "Verifies AMSI scan detects debug suspicious content" {
   20 
   21             $EICAR_STRING_B64 = "awZ8EmMWc3JjaAdvY2lrBgcbY20aBHBwGgROF3Z6cHJhHmBncn13cmF3HnJ9Z3plemFmYB5ndmBnHnV6f3YSF3sYexk= "
   22             $bytes = [System.Convert]::FromBase64String($EICAR_STRING_B64)
   23             $EICAR_STRING = -join ($bytes | ForEach-Object { [char]($_ -bxor 0x33) })
   24             { Invoke-Expression -Command "echo '$EICAR_STRING'" } |
   25                 Should -Throw -ErrorId "ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand"
   26         }
   27     }
   28 }
   29 finally
   30 {
   31     if ($defaultParamValues -ne $null)
   32     {
   33         $Global:PSDefaultParameterValues = $defaultParamValues
   34     }
   35 }