Using AMSI with Carbon Black EDR

AMSI events can be forwarded through the Event Forwarder in JSON and LEEF.

Carbon Black EDR Windows sensors perform asynchronous RPC calls; the sensor captures commands and script contents that PowerShell executes.

PowerShell script block logging must be enabled. Verify that this is not turned OFF in HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging .