asked on AmsiContext errors reported from a PowerShell script running from the Task Scheduler
Since last week, after a server reboot, my powershell scripts running from the tasks scheduler are reporting a strange errors in the logs:
**********************
Windows PowerShell transcript start
Start time: 20211213060003
Username: XXX\yyy
RunAs User: XXX\yyy
Machine: FGLAPPS01 (Microsoft Windows NT 10.0.14393.0)
Host Application: powershell.exe -ExecutionPolicy ByPass -Noninteractive -Noprofile -Command & {&'D:\Apps\FGLApps\Tasks\AzureSiteRecoveryStatus.ps1' }
Process ID: 2728
PSVersion: 5.1.14393.4583
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.4583
BuildVersion: 10.0.14393.4583
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Remove-Variable : Cannot find a variable with the name 'AmsiContext'.
At line:479 char:5
+ Remove-Variable AmsiContext -Scope local -Confirm:$false
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (AmsiContext:String) [Remove-Variable], ItemNotFoundException
+ FullyQualifiedErrorId : VariableNotFound,Microsoft.PowerShell.Commands.RemoveVariableCommand
Remove-Variable : Cannot find a variable with the name 'AmsiInitFailed'.
At line:480 char:5
+ Remove-Variable AmsiInitFailed -Scope local -Confirm:$false
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (AmsiInitFailed:String) [Remove-Variable], ItemNotFoundException
+ FullyQualifiedErrorId : VariableNotFound,Microsoft.PowerShell.Commands.RemoveVariableCommand
Remove-Variable : Cannot find a variable with the name 'AmsiContext'.
At line:479 char:5
It looks like the tasks are running normally but running much slower. Also logs are just unreadable because of these errors. A log that had 250 lines a week ago is not containing 24,500 lines.
I have found 2 interesting links on AMSI but not sure on how to apply any fix: https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/ & https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
One strange thing is that issue seems to be related to the Task Scheduler as the very same script runs perfectly fine from the PowerShell ISE.
Also, if I removed the Start-Transcript, scripts run in seconds as it used to do.
One last thing, not sure if it is related or not, we have installed SentinelOne on that server 2 weeks ago but only restarted the server last week. The problem described here started just after the reboot.
Anyway of keeping my logs but not being affected by AMSI?