Package proposal: amsiscriptcontentretrieval.vm

### Package Name

amsiscriptcontentretrieval

### Tool Name

AMSIScriptContentRetrieval

### Package type

SINGLE_PS1

### Tool's version number

2018.06.17

### Category

PowerShell

### Tool's authors

Matt Graeber

### Tool's description

Retrieves data from the Microsoft Antimalware Scan Interface (AMSI)

### Download URL

https://gist.githubusercontent.com/mattifestation/e179218d88b5f100b0edecdec453d9be/raw/2329bda456b5b8e2f973cc5dc026b6fc221dad79/AMSIScriptContentRetrieval.ps1

### Download SHA256 Hash

4ad1712633ef5db299dbfa8565bca899fefcdf4affab9b052768236f8e4c6272

### Why is this tool a good addition?

Antimalware Scan Interface (AMSI) is a Microsoft method of observing malicious scripts, including VBA macros, XLM macros, PowerShell, JavaScript, and VBScript scripts.

## Starting ASMI monitoring

In PowerShell, run

> logman start AMSITrace -p Microsoft-Antimalware-Scan-Interface Event1 -o AMSITRace.etl -ets

Then run the script you wish to monitor.

## Stopping monitoring

In PowerShell, run

> logman stop AMSITrace -ets

Viewing the results

In PowerShell, run

[AMSIScriptContentRetrieval](https://gist.githubusercontent.com/mattifestation/e179218d88b5f100b0edecdec453d9be/raw/2329bda456b5b8e2f973cc5dc026b6fc221dad79/AMSIScriptContentRetrieval.ps1)

Start by reviewing the repository's existing package layout and use the provided AMSIScriptContentRetrieval.ps1 download URL and SHA256 hash as the package inputs. Confirm the package metadata matches the proposal, the PowerShell script is retrievable and its hash verifies, and the package is available for the VM environment.

Written by the indexing model from the issue text.