MegaBites-AI/Windows-powershell

1# Copyright (c) Microsoft Corporation.2# Licensed under the MIT License.3 4try5{6    $defaultParamValues = $PSDefaultParameterValues.Clone()7    $PSDefaultParameterValues["it:Skip"] = !$IsWindows8 9    Describe "AMSI scan should detect suspicious content" -Tags 'Feature','RequireAdminOnWindows' {10 11        BeforeAll {12            [System.Management.Automation.Internal.InternalTestHooks]::SetTestHook("UseDebugAmsiImplementation", $true)13        }14 15        AfterAll {16            [System.Management.Automation.Internal.InternalTestHooks]::SetTestHook("UseDebugAmsiImplementation", $false)17        }18 19        It "Verifies AMSI scan detects debug suspicious content" {20 21            $EICAR_STRING_B64 = "awZ8EmMWc3JjaAdvY2lrBgcbY20aBHBwGgROF3Z6cHJhHmBncn13cmF3HnJ9Z3plemFmYB5ndmBnHnV6f3YSF3sYexk= "22            $bytes = [System.Convert]::FromBase64String($EICAR_STRING_B64)23            $EICAR_STRING = -join ($bytes | ForEach-Object { [char]($_ -bxor 0x33) })24            { Invoke-Expression -Command "echo '$EICAR_STRING'" } |25                Should -Throw -ErrorId "ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand"26        }27    }28}29finally30{31    if ($defaultParamValues -ne $null)32    {33        $Global:PSDefaultParameterValues = $defaultParamValues34    }35}36