Add Attack Surface Analyzer Script by TravisEz13 · Pull Request #26379 · PowerShell/PowerShell

TravisEz13 · 2025-11-04T19:15:06Z

PR Summary

This pull request introduces a new Attack Surface Analyzer (ASA) testing workflow for PowerShell MSI installations, leveraging Docker containers for automated and reproducible security analysis. It adds a comprehensive README.md and a multi-stage Dockerfile to the tools/AttackSurfaceAnalyzer directory, detailing how to run ASA tests locally or in CI/CD, and how to extract results efficiently. Additionally, minor updates are made to CI configurations to support new packaging workflows.

New ASA Testing Tools and Documentation:

Added a detailed README.md to tools/AttackSurfaceAnalyzer explaining ASA testing, usage instructions, Docker architecture, troubleshooting, and integration with CI/CD pipelines.
Introduced a multi-stage Dockerfile in tools/AttackSurfaceAnalyzer/docker/ for building containers that run ASA tests, capture baseline and post-installation snapshots, export SARIF and SQLite results, and enable clean extraction of reports.

PR Context

PR Checklist

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

…alls MSI Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

… and directories Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

…ated directories Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

… execution Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

…utomatic installation via winget

… and startup

… handling

…ectory

…pdate scripts to use the static Dockerfile for building the Attack Surface Analyzer container.

…ild for optimized result extraction in Run-AttackSurfaceAnalyzer.ps1

…xt and improve installation logging

…or output path and report extraction

Copilot

Pull Request Overview

This PR adds Attack Surface Analyzer (ASA) testing tooling for local PowerShell MSI analysis using Docker containers. It provides a PowerShell script and Dockerfile to automate the process of running ASA tests in a clean Windows container environment.

Key changes:

New Run-AttackSurfaceAnalyzer.ps1 script with automatic Docker setup and MSI building capabilities
Multi-stage Dockerfile for running ASA tests in isolated Windows containers
Updated Windows packaging workflow to include a stable x64 build configuration
Documentation and .gitignore updates for ASA test results

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tools/AttackSurfaceAnalyzer/docker/Dockerfile	Multi-stage Dockerfile defining ASA test execution environment with baseline/post-install snapshots
tools/AttackSurfaceAnalyzer/Run-AttackSurfaceAnalyzer.ps1	PowerShell script orchestrating Docker setup, MSI building, ASA test execution, and result extraction
tools/AttackSurfaceAnalyzer/README.md	Documentation for ASA testing workflow, prerequisites, and usage examples
.gitignore	Excludes ASA test results directory from version control
.github/workflows/windows-packaging-reusable.yml	Adds stable channel x64 build matrix entry

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…thub.com/travisez13/powershell into copilot/add-attack-surface-analyzer-test

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ts format instead of SARIF

…thub.com/travisez13/powershell into copilot/add-attack-surface-analyzer-test

…alyzer results

… verification

…ce result exporting

…ormational and debug events, and update examples and parameters for clarity.

…ils and limit output for file-related categories

…ignatures, grouped by issuer, and limit output for other file-related categories.

…h and display all files, removing expiration date sorting and display limits.

…saResults.ps1

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI and others added 30 commits October 19, 2025 19:06

Initial plan

a24e1bf

Add Attack Surface Analyzer test to windows packaging workflow

86840bb

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Remove redundant MSI installation step - Invoke-CIFinish already inst…

ed49207

…alls MSI Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Add windows-packaging-reusable.yml to path filters for packagingChanged

2641bc4

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Merge branch 'master' into copilot/add-attack-surface-analyzer-test

d08b674

Pin Attack Surface Analyzer version to 2.4.176

f8ded68

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Merge branch 'master' into copilot/add-attack-surface-analyzer-test

2871343

Update Attack Surface Analyzer version to 2.3.328

aeb83d3

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Merge branch 'master' into copilot/add-attack-surface-analyzer-test

d747f95

Optimize ASA collection for faster execution with targeted collectors…

dfc6268

… and directories Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Add C:\Windows monitoring and EventLog collector to ASA configuration

9ab76e0

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Fix ASA command syntax to use correct collector flags and comma-separ…

a659f5d

…ated directories Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Narrow Windows monitoring to System32\PowerShell directory for faster…

43975f3

… execution Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Upload Attack Surface Analyzer results as artifacts for analysis

6bf0707

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Apply suggestion from @TravisEz13

25a9001

Add SARIF output file to ASA results artifact upload

0315cbd

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Run ASA only for x64/stable matrix configuration

fbce5e9

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Merge branch 'master' into copilot/add-attack-surface-analyzer-test

9c201e5

Move ASA to Windows container for clean baseline testing

de2d81f

Co-authored-by: TravisEz13 <10873629+TravisEz13@users.noreply.github.com>

Add Dockerfile and PowerShell script for Attack Surface Analyzer testing

8b472da

Remove Attack Surface Analyzer steps from Windows packaging workflow

fe088e8

Enhance README and script to clarify MSI handling and build process

e5a165c

Enhance Docker installation process in README and script to support a…

db78997

…utomatic installation via winget

Enhance Docker handling in README and script to automate installation…

b4bb32d

… and startup

Refactor Run-AttackSurfaceAnalyzer.ps1 for improved logging and error…

a9bf342

… handling

Improve MSI detection logic to check both repo root and artifacts dir…

8f8e916

…ectory

Refactor Docker setup: move Dockerfile to a dedicated subfolder and u…

15da07c

…pdate scripts to use the static Dockerfile for building the Attack Surface Analyzer container.

Enhance README and Dockerfile documentation; implement multi-stage bu…

a3fd13b

…ild for optimized result extraction in Run-AttackSurfaceAnalyzer.ps1

Refactor MSI handling in Docker setup: copy MSI to Docker build conte…

14d034c

…xt and improve installation logging

Update .gitignore and README; enhance Run-AttackSurfaceAnalyzer.ps1 f…

02ac17b

…or output path and report extraction

TravisEz13 commented Nov 4, 2025

View reviewed changes

Comment thread .github/workflows/windows-packaging-reusable.yml Outdated

Apply suggestion from @TravisEz13

7343d36

Copilot AI reviewed Nov 4, 2025

View reviewed changes

Merge branch 'copilot/add-attack-surface-analyzer-test' of https://gi…

787c5d1

…thub.com/travisez13/powershell into copilot/add-attack-surface-analyzer-test

TravisEz13 mentioned this pull request Nov 4, 2025

Add Attack Surface Analyzer test in Windows container to Windows packaging workflow for x64/stable #26246

Closed

TravisEz13 and others added 16 commits November 4, 2025 11:57

Update tools/AttackSurfaceAnalyzer/README.md

c86876c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update tools/AttackSurfaceAnalyzer/README.md

669283f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update tools/AttackSurfaceAnalyzer/Run-AttackSurfaceAnalyzer.ps1

e80288b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update tools/AttackSurfaceAnalyzer/Run-AttackSurfaceAnalyzer.ps1

5664410

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update tools/AttackSurfaceAnalyzer/Run-AttackSurfaceAnalyzer.ps1

c5cca9b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update Run-AttackSurfaceAnalyzer.ps1 and Dockerfile to use JSON resul…

38cfdb7

…ts format instead of SARIF

Merge branch 'copilot/add-attack-surface-analyzer-test' of https://gi…

d054fbd

…thub.com/travisez13/powershell into copilot/add-attack-surface-analyzer-test

Add Summarize-AsaResults.ps1 script for summarizing Attack Surface An…

1a7a0c2

…alyzer results

Refine Run-AttackSurfaceAnalyzer.ps1 parameters and add MSI signature…

385003e

… verification

Update README.md and Dockerfile to clarify MSI requirements and enhan…

37b2ed9

…ce result exporting

Enhance Summarize-AsaResults.ps1 to include filtering options for inf…

5513e65

…ormational and debug events, and update examples and parameters for clarity.

Enhance Write-ConsoleSummary function to display individual file deta…

1b887fb

…ils and limit output for file-related categories

Enhance Write-ConsoleSummary function to display files with expired s…

e1045b6

…ignatures, grouped by issuer, and limit output for other file-related categories.

Refactor Write-ConsoleSummary function to sort files by full file pat…

18cde5f

…h and display all files, removing expiration date sorting and display limits.

Add copyright notice to Run-AttackSurfaceAnalyzer.ps1 and Summarize-A…

637dd4a

…saResults.ps1

Add copyright notice to Dockerfile

20a9530

adityapatwardhan approved these changes Nov 4, 2025

View reviewed changes

Update Dockerfile to specify image digests for consistency

0e2bab7

TravisEz13 added the CL-Tools Indicates that a PR should be marked as a tools change in the Change Log label Nov 4, 2025

TravisEz13 enabled auto-merge (squash) November 4, 2025 23:18

adityapatwardhan approved these changes Nov 4, 2025

View reviewed changes

TravisEz13 merged commit 1ba5974 into PowerShell:master Nov 4, 2025
35 of 44 checks passed

TravisEz13 deleted the copilot/add-attack-surface-analyzer-test branch November 4, 2025 23:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Attack Surface Analyzer Script#26379

Add Attack Surface Analyzer Script#26379
TravisEz13 merged 54 commits intoPowerShell:masterfrom
TravisEz13:copilot/add-attack-surface-analyzer-test

TravisEz13 commented Nov 4, 2025 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

TravisEz13 commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

PR Context

PR Checklist

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TravisEz13 commented Nov 4, 2025 •

edited

Loading