Repository navigation
How can I disable PSAMSIMethodInvocationLogging #21491
Description
Summary of the new feature / enhancement
As a user I do not want any logging or tracing of invocations of .NET methods either collected or passed to other components.
Proposed technical implementation details (optional)
In order to comply with How the Antimalware Scan Interface (AMSI) helps you defend against malware it should be restricted to those mechanisms that take an entire script or string and either execute it or create a script block.
It should not log every single method, passing private data to 2nd or 3rd party dlls.
It should at most scan the script itself, not the expanded variable values.
It should only deal with fileless threats.
It should not log/scan anything that comes from a script read from the file system - that is considered already trusted
Neither should it need to scan signed scripts, again that should already be trusted
Activity
SteveL-MSFT commentedon Apr 22, 2024
WG reviewed this and this logging is required on Windows to provide protection via Windows Defender (or possibly other AMSI compliant scanners).
SteveL-MSFT commentedon Apr 23, 2024
In your first case, I believe the actual script block to be executed (meaning variable expansion) is sent to AMSI so you can't hide executable code within a variable.
in your second case, those reports appears to be due to the large script for the Concise ErrorView formatting. So any script executed during formatting would also be sent to AMSI since 3rd parties can add their own scripts during formatting.
microsoft-github-policy-service commentedon Apr 25, 2024
This issue has been marked as by-design and has not had any activity for 1 day. It has been closed for housekeeping purposes.
microsoft-github-policy-service commentedon Apr 25, 2024
📣 Hey rhubarb-geek-nz, how did we do? We would love to hear your feedback with the link below! 🗣️
🔗 https://aka.ms/PSRepoFeedback