Skip to content

Instantly share code, notes, and snippets.

@mattifestation
Last active October 29, 2022 14:28
Show Gist options
  • Save mattifestation/dfdd41e5020f4286e9b6486545abc359 to your computer and use it in GitHub Desktop.
Save mattifestation/dfdd41e5020f4286e9b6486545abc359 to your computer and use it in GitHub Desktop.
Enables AMSI logging to the AMSI/Operational event log
$AutoLoggerName = 'MyAMSILogger'
$AutoLoggerGuid = "{$((New-Guid).Guid)}"
New-AutologgerConfig -Name $AutoLoggerName -Guid $AutoLoggerGuid -Start Enabled
Add-EtwTraceProvider -AutologgerName $AutoLoggerName -Guid '{2A576B87-09A7-520E-C21A-4942F0271D67}' -Level 0xff -MatchAnyKeyword ([UInt64] (0x8000000000000001 -band ([UInt64]::MaxValue))) -Property 0x41
@johnmccash
Copy link

It does indeed appear to be gone in Win10 20H2. That said, I was never able to get anything logged previously using this technique, though I'm really not certain why.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment