AMSITrigger will identify all of the malicious strings in a powershell file, by repeatedly making calls to AMSI using AMSIScanBuffer .
Hunting For Malicious Strings
Usage
-i, –inputfile=VALUE Powershell filename
-u, –url=VALUE URL eg. https://10.1.1.1/Invoke-NinjaCopy.ps1
-f, –format=VALUE Output Format:
1 – Only show Triggers
2 – Show Triggers with Line numbers
3 – Show Triggers inline with code
4 – Show AMSI calls (xmas tree mode)
-d, –debug Show Debug Info
-m, –maxsiglength=VALUE Maximum signature Length to cater for,
default=2048
-c, –chunksize=VALUE Chunk size to send to AMSIScanBuffer,
default=4096
-h, -?, –help Show Help
