Avatar of Éric Moreau
Éric MoreauFlag for Canada

asked on 

AmsiContext errors reported from a PowerShell script running from the Task Scheduler

Since last week, after a server reboot, my powershell scripts running from the tasks scheduler are reporting a strange errors in the logs:

**********************
Windows PowerShell transcript start
Start time: 20211213060003 Username: XXX\yyy RunAs User: XXX\yyy Machine: FGLAPPS01 (Microsoft Windows NT 10.0.14393.0) Host Application: powershell.exe -ExecutionPolicy ByPass -Noninteractive -Noprofile -Command & {&'D:\Apps\FGLApps\Tasks\AzureSiteRecoveryStatus.ps1' } Process ID: 2728 PSVersion: 5.1.14393.4583 PSEdition: Desktop PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.4583 BuildVersion: 10.0.14393.4583 CLRVersion: 4.0.30319.42000 WSManStackVersion: 3.0 PSRemotingProtocolVersion: 2.3 SerializationVersion: 1.1.0.1 ********************** Remove-Variable : Cannot find a variable with the name 'AmsiContext'. At line:479 char:5 +     Remove-Variable AmsiContext -Scope local -Confirm:$false +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     + CategoryInfo          : ObjectNotFound: (AmsiContext:String) [Remove-Variable], ItemNotFoundException     + FullyQualifiedErrorId : VariableNotFound,Microsoft.PowerShell.Commands.RemoveVariableCommand Remove-Variable : Cannot find a variable with the name 'AmsiInitFailed'. At line:480 char:5 +     Remove-Variable AmsiInitFailed -Scope local -Confirm:$false +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     + CategoryInfo          : ObjectNotFound: (AmsiInitFailed:String) [Remove-Variable], ItemNotFoundException     + FullyQualifiedErrorId : VariableNotFound,Microsoft.PowerShell.Commands.RemoveVariableCommand Remove-Variable : Cannot find a variable with the name 'AmsiContext'. At line:479 char:5

Open in new window


It looks like the tasks are running normally but running much slower. Also logs are just unreadable because of these errors. A log that had 250 lines a week ago is not containing 24,500 lines.


I have found 2 interesting links on AMSI but not sure on how to apply any fix: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ & https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/


One strange thing is that issue seems to be related to the Task Scheduler as the very same script runs perfectly fine from the PowerShell ISE.


Also, if I removed the Start-Transcript, scripts run in seconds as it used to do.


One last thing, not sure if it is related or not, we have installed SentinelOne on that server 2 weeks ago but only restarted the server last week. The problem described here started just after the reboot.


Anyway of keeping my logs but not being affected by AMSI?

PowershellWindows OSMicrosoft

Avatar of undefined
Last Comment
Éric Moreau
ASKER CERTIFIED SOLUTION
Avatar of Éric Moreau
Éric Moreau
Flag of Canada image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Windows OS
Windows OS

This topic area includes legacy versions of Windows prior to Windows 2000: Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions including Windows Mobile.

129K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews

TRUSTED BY

IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo