RythmStick/AMSITrigger

Health v2 · maintenance only

Adoption not part of the score

1415 stars · 181 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

AMSITrigger is a C# command-line tool that identifies the specific strings in PowerShell scripts that trigger Microsoft's Antimalware Scan Interface (AMSI) detections. It feeds script chunks to AmsiScanBuffer and reports which code segments would be flagged as malicious.

Use cases

• find which lines of my powershell script trigger defender
• identify amsi signatures in a ps1 file
• test if a powershell payload gets flagged by amsi
• scan a script from a url for malicious string detections
• pinpoint the exact code causing av detection in my tooling

When to choose

• you write or modify PowerShell offensive tooling and need to know what triggers AMSI
• you want to isolate the minimal malicious snippet in a large script
• you need a fast local signature check before running a script

When to avoid

• you need general antivirus scanning or malware removal
• you are analyzing non-PowerShell payloads
• you need runtime AMSI bypass rather than static trigger identification

Facets

cli-tool · maturity active

security penetration-testing cli security penetration-testing developer-tools windows cross-platform cli amsi powershell malware-analysis red-team signature-scanning csharp

Member repositories

For agents

markdown · JSON · MCP: product_card(name="RythmStick/AMSITrigger")