# RythmStick/AMSITrigger

The Hunt for Malicious Strings

Repository: https://github.com/RythmStick/AMSITrigger
Canonical: https://ross.abutalabs.com/products/amsitrigger
Language: C#
License: GPL-3.0
License Family: copyleft
Last push: 2025-05-13T21:32:43+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 21, release rhythm 8, longevity 100
- inputs: {"age_days": 2289, "days_push": 477, "days_rel": 477, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1415, forks 181 (observed 2026-08-28T04:04:39.806505+00:00)

## What it is
AMSITrigger is a C# command-line tool that identifies the specific strings in PowerShell scripts that trigger Microsoft's Antimalware Scan Interface (AMSI) detections. It feeds script chunks to AmsiScanBuffer and reports which code segments would be flagged as malicious.

## Use cases
- find which lines of my powershell script trigger defender
- identify amsi signatures in a ps1 file
- test if a powershell payload gets flagged by amsi
- scan a script from a url for malicious string detections
- pinpoint the exact code causing av detection in my tooling

## When to choose
- you write or modify PowerShell offensive tooling and need to know what triggers AMSI
- you want to isolate the minimal malicious snippet in a large script
- you need a fast local signature check before running a script

## When to avoid
- you need general antivirus scanning or malware removal
- you are analyzing non-PowerShell payloads
- you need runtime AMSI bypass rather than static trigger identification

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cli
- domain: security, penetration-testing, developer-tools
- platform: windows, cross-platform, cli
- tags: amsi, powershell, malware-analysis, red-team, signature-scanning, csharp

## Member repositories
- RythmStick/AMSITrigger (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:39.806505+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:38:08.075963+00:00, confidence not recorded.
  - readme: https://github.com/RythmStick/AMSITrigger (fetched 2026-08-28T04:04:39.806505+00:00, sha 0248110a1432)
- Data as of 2026-08-30T08:39:29.467469+00:00.