AMSITrigger : The Hunt For Malicious Strings

AMSITrigger will identify all of the malicious strings in a powershell file, by repeatedly making calls to AMSI using AMSIScanBuffer .

Hunting For Malicious Strings

Usage

-i, –inputfile=VALUE Powershell filename
-u, –url=VALUE URL eg. https://10.1.1.1/Invoke-NinjaCopy.ps1
-f, –format=VALUE Output Format:
1 – Only show Triggers
2 – Show Triggers with Line numbers
3 – Show Triggers inline with code
4 – Show AMSI calls (xmas tree mode)
-d, –debug Show Debug Info
-m, –maxsiglength=VALUE Maximum signature Length to cater for,
default=2048
-c, –chunksize=VALUE Chunk size to send to AMSIScanBuffer,
default=4096
-h, -?, –help Show Help

R K

Recent Posts

How Do I Do Reverse Image Search

Have you ever come across a picture on the internet and wondered where it came…

5 days ago

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

2 weeks ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

2 weeks ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

2 weeks ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

2 weeks ago

Essential Commands for Linux User Listing

Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…

2 weeks ago