Skip to content

Instantly share code, notes, and snippets.

@rmusser01

rmusser01/EnableAMSILogging.ps1

Forked from mattifestation/EnableAMSILogging.ps1
Created May 6, 2020 21:13
Show Gist options
  • Save rmusser01/91cdc135c8bab90a294b08c3d4a456d6 to your computer and use it in GitHub Desktop.
Save rmusser01/91cdc135c8bab90a294b08c3d4a456d6 to your computer and use it in GitHub Desktop.
Download ZIP
Enables AMSI logging to the AMSI/Operational event log
Raw
EnableAMSILogging.ps1
$AutoLoggerName = 'MyAMSILogger'
$AutoLoggerGuid = "{$((New-Guid).Guid)}"
New-AutologgerConfig -Name $AutoLoggerName -Guid $AutoLoggerGuid -Start Enabled
Add-EtwTraceProvider -AutologgerName $AutoLoggerName -Guid '{2A576B87-09A7-520E-C21A-4942F0271D67}' -Level 0xff -MatchAnyKeyword ([UInt64] (0x8000000000000001 -band ([UInt64]::MaxValue))) -Property 0x41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment