diff --git a/build.psm1 b/build.psm1
index d4f090b..4569b19 100644
--- a/build.psm1
+++ b/build.psm1
@@ -529,11 +529,7 @@ function Start-BuildPowerShellNativePackage
 
         [Parameter(Mandatory = $true)]
         [ValidateScript({Test-Path $_ -PathType Leaf})]
-        [string] $macOSZipPath,
-
-        [Parameter(Mandatory = $true)]
-        [ValidateScript({Test-Path $_ -PathType Leaf})]
-        [string] $psrpZipPath
+        [string] $macOSZipPath
     )
 
     if(-not (Test-Path $PackageRoot))
@@ -554,7 +550,6 @@ function Start-BuildPowerShellNativePackage
     $BinFolderLinuxARM64 = Join-Path $tempExtractionPath "LinuxARM64"
     $BinFolderLinuxAlpine = Join-Path $tempExtractionPath "LinuxAlpine"
     $BinFolderMacOS = Join-Path $tempExtractionPath "MacOS"
-    $BinFolderPSRP = Join-Path $tempExtractionPath "PSRP"
 
     Expand-Archive -Path $WindowsX64ZipPath -DestinationPath $BinFolderX64 -Force
     Expand-Archive -Path $WindowsX86ZipPath -DestinationPath $BinFolderX86 -Force
@@ -565,11 +560,10 @@ function Start-BuildPowerShellNativePackage
     Expand-Archive -Path $LinuxARMZipPath -DestinationPath $BinFolderLinuxARM -Force
     Expand-Archive -Path $LinuxARM64ZipPath -DestinationPath $BinFolderLinuxARM64 -Force
     Expand-Archive -Path $macOSZipPath -DestinationPath $BinFolderMacOS -Force
-    Expand-Archive -Path $psrpZipPath -DestinationPath $BinFolderPSRP -Force
 
     PlaceWindowsNativeBinaries -PackageRoot $PackageRoot -BinFolderX64 $BinFolderX64 -BinFolderX86 $BinFolderX86 -BinFolderARM $BinFolderARM -BinFolderARM64 $BinFolderARM64
 
-    PlaceUnixBinaries -PackageRoot $PackageRoot -BinFolderLinux $BinFolderLinux -BinFolderLinuxARM $BinFolderLinuxARM -BinFolderLinuxARM64 $BinFolderLinuxARM64 -BinFolderOSX $BinFolderMacOS -BinFolderPSRP $BinFolderPSRP -BinFolderLinuxAlpine $BinFolderLinuxAlpine
+    PlaceUnixBinaries -PackageRoot $PackageRoot -BinFolderLinux $BinFolderLinux -BinFolderLinuxARM $BinFolderLinuxARM -BinFolderLinuxARM64 $BinFolderLinuxARM64 -BinFolderOSX $BinFolderMacOS -BinFolderLinuxAlpine $BinFolderLinuxAlpine
 
     $Nuspec = @'
 <?xml version="1.0" encoding="utf-8"?>
@@ -657,11 +651,7 @@ function PlaceUnixBinaries
 
         [Parameter(Mandatory = $true)]
         [ValidateScript({Test-Path $_ -PathType Container})]
-        $BinFolderOSX,
-
-        [Parameter(Mandatory = $true)]
-        [ValidateScript({Test-Path $_ -PathType Container})]
-        $BinFolderPSRP
+        $BinFolderOSX
     )
 
     $RuntimePathLinux = New-Item -ItemType Directory -Path (Join-Path $PackageRoot -ChildPath 'runtimes/linux-x64/native') -Force
@@ -675,12 +665,6 @@ function PlaceUnixBinaries
     Copy-Item "$BinFolderLinuxARM64\*" -Destination $RuntimePathLinuxARM64 -Verbose
     Copy-Item "$BinFolderLinuxAlpine\*" -Destination $RuntimePathLinuxAlpine -Verbose
     Copy-Item "$BinFolderOSX\*" -Destination $RuntimePathOSX -Verbose
-
-    ## LinuxARM is not supported by PSRP
-    Get-ChildItem -Recurse $BinFolderPSRP/*.dylib | ForEach-Object { Copy-Item $_.FullName -Destination $RuntimePathOSX -Verbose }
-    Get-ChildItem -Recurse $BinFolderPSRP/*.so | ForEach-Object { Copy-Item $_.FullName -Destination $RuntimePathLinux -Verbose }
-
-    Copy-Item $BinFolderPSRP/version.txt -Destination "$PackageRoot/PSRP_version.txt" -Verbose
 }
 
 <#
diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index b1c239b..8019539 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -2184,7 +2184,43 @@
               value="0x6017"
               version="1"
               />
-        </events>
+          <event
+                channel="C_ANALYTIC"
+                keywords="AmsiState"
+                level="win:Verbose"
+                message="$(string.PS_PROVIDER.event.E_A_AmsiState.message)"
+                opcode="Method"
+                symbol="AmsiState"
+                task="Amsi"
+                template="T_AmsiState"
+                value="0x4001"
+                version="1"
+              />
+          <event
+                channel="C_ANALYTIC"
+                keywords="WDACQuery"
+                level="win:Verbose"
+                message="$(string.PS_PROVIDER.event.E_A_WDACQuery.message)"
+                opcode="Method"
+                symbol="WDACQuery"
+                task="WDAC"
+                template="T_WDACQuery"
+                value="0x4002"
+                version="1"
+              />
+          <event
+                channel="C_ANALYTIC"
+                keywords="WDACAudit"
+                level="win:Verbose"
+                message = "$(string.PS_PROVIDER.event.E_A_WDACAudit.message)"
+                opcode="Method"
+                symbol="WDACAudit"
+                task="WDACAudit"
+                template="T_WDACAudit"
+                value="0x4003"
+                version="1"
+              />
+          </events>
         <channels>
           <!--There are two channels defined for Windows PowerShell instrumentation
               event provider
@@ -2407,6 +2443,24 @@
               symbol="T_ISEOperation"
               value="120"
               />
+          <task
+              message="$(string.PS_PROVIDER.task.T_AmsiState.message)"
+              name="Amsi"
+              symbol="T_Amsi"
+              value="130"
+              />
+          <task
+              message="$(string.PS_PROVIDER.task.T_WDACQuery.message)"
+              name="WDAC"
+              symbol="T_WDAC"
+              value="131"
+              />
+          <task
+              message="$(string.PS_PROVIDER.task.T_WDACAudit.message)"
+              name="WDACAudit"
+              symbol="T_WDACAudit"
+              value="132"
+              />
         </tasks>
         <opcodes>
           <opcode
@@ -2567,6 +2621,24 @@
               name="PSWorkflow"
               symbol="K_PSWORKFLOW"
               />
+          <keyword
+              mask="0x400"
+              message="$(string.PS_PROVIDER.keyword.K_AmsiState.message)"
+              name="AmsiState"
+              symbol="K_AmsiState"
+              />
+          <keyword
+              mask="0x800"
+              message="$(string.PS_PROVIDER.keyword.K_WDACQuery.message)"
+              name="WDACQuery"
+              symbol="K_WDACQuery"
+              />
+          <keyword
+              mask="0x1000"
+              message="$(string.PS_PROVIDER.keyword.K_WDACAudit.message)"
+              name="WDACAudit"
+              symbol="K_WDACAudit"
+              />
         </keywords>
         <maps>
           <!-- please keep in sync with SerializationMethod from
@@ -4024,6 +4096,48 @@
                 name="FileName"
                 />
           </template>
+          <template tid="T_AmsiState">
+            <data
+                inType="win:UnicodeString"
+                name="Action"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="AmsiContext"
+                />
+          </template>
+          <template tid="T_WDACQuery">
+            <data
+                inType="win:UnicodeString"
+                name="QueryName"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="FileName"
+                />
+            <data
+                inType="win:Int32"
+                name="QuerySuccess"
+                />
+            <data
+                inType="win:Int32"
+                name="QuerySResult"
+                />
+          </template>
+          <template tid="T_WDACAudit">
+            <data
+                inType="win:UnicodeString"
+                name="Title"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="Message"
+                />
+            <data
+                inType="win:UnicodeString"
+                name="FullyQualifiedId"
+                />
+          </template>
         </templates>
       </provider>
     </events>
@@ -4803,7 +4917,7 @@
             />
         <string
             id="PS_PROVIDER.event.E_A_CREATE_SERVER_REMOTESESSION.message"
-            value="Request %1. Creating a server remote session. UserName: %2 Custome Shell Id: %3"
+            value="Request %1. Creating a server remote session. UserName: %2 Custom Shell Id: %3"
             />
         <string
             id="PS_PROVIDER.event.E_A_REPORT_CONTEXT.message"
@@ -4917,6 +5031,10 @@
             id="PS_PROVIDER.event.E_O_M3PWorkflowExecutionStarted.message"
             value="Workflow execution started. %n %t WorkflowId: %1 %n %t ManagedNodes: %2"
             />
+          <string
+              id="PS_PROVIDER.event.E_A_AmsiState.message"
+              value="AmsiUtil state. %n %t state: %1 %n %t Context: %2"
+            />
         <string
             id="PS_PROVIDER.event.E_O_M3PEndpointRegistered.message"
             value="A new PowerShell endpoint was registered. %n %t EndpointName: %1 %n %t EndpointType: %2 %n %t RegisteredBy: %3"
@@ -5385,7 +5503,11 @@
             id="PS_PROVIDER.keyword.K_PSWORKFLOW.message"
             value="PSWorkflow Hosting And Execution Layer"
             />
-        <string
+          <string
+              id="PS_PROVIDER.keyword.K_AmsiState.message"
+              value="Amsi state"
+            />
+          <string
             id="PS_PROVIDER.keyword.K_SESSION.message"
             value="All session layer"
             />
@@ -5545,7 +5667,11 @@
             id="PS_PROVIDER.task.T_ISEOperation.message"
             value="PowerShell ISE Operation"
             />
-        <string
+          <string
+              id="PS_PROVIDER.task.T_AmsiState.message"
+              value="Amsi State"
+            />
+          <string
             id="PS_PROVIDER.event.E_O_ISEExecuteScript.message"
             value="Windows PowerShell ISE has started to run script file %1."
             />
@@ -5629,6 +5755,30 @@
             id="PS_PROVIDER.event.E_O_REMOTE_NAMEDPIPE_DISCONNECT.message"
             value="Windows PowerShell IPC disconnect on process: %1 in AppDomain: %2 for User: %3."
             />
+        <string
+            id="PS_PROVIDER.event.E_A_WDACQuery.message"
+            value="WDAC Query. %n %t Query: %1 %n %t File: %2 %n %t SuccessCode: %3 %n %t ResultCode: %4"
+            />
+        <string
+            id="PS_PROVIDER.keyword.K_WDACQuery.message"
+            value="WDAC Query"
+            />
+        <string
+            id="PS_PROVIDER.task.T_WDACQuery.message"
+            value="WDAC Query"
+            />
+        <string
+            id="PS_PROVIDER.event.E_A_WDACAudit.message"
+            value="WDAC Audit. %n %t Title: %1 %n %t Message: %2 %n %t FullyQualifiedId: %3"
+            />
+        <string
+            id="PS_PROVIDER.keyword.K_WDACAudit.message"
+            value="WDAC Audit"
+            />
+        <string
+            id="PS_PROVIDER.task.T_WDACAudit.message"
+            value="WDAC Audit"
+            />
       </stringTable>
     </resources>
   </localization>
diff --git a/src/libpsl-native/CMakeLists.txt b/src/libpsl-native/CMakeLists.txt
index e4f33cc..ce0e198 100644
--- a/src/libpsl-native/CMakeLists.txt
+++ b/src/libpsl-native/CMakeLists.txt
@@ -3,7 +3,7 @@ project(PSL-NATIVE)
 
 # Can't use add_compile_options with 2.8.11
 set(CMAKE_BUILD_TYPE "Release")
-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11 -Wall -Werror -fstack-protector-strong -fpie -DFORTIFY_SOURCE=2 -O2")
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11 -Wall -Werror -fstack-protector-strong -fpie -D_FORTIFY_SOURCE=2")
 
 if (${CMAKE_SYSTEM_NAME} MATCHES "Linux")
     set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-z,relro,-z,now")
diff --git a/src/libpsl-native/arm.toolchain.cmake b/src/libpsl-native/arm.toolchain.cmake
index c2c6810..f514d40 100644
--- a/src/libpsl-native/arm.toolchain.cmake
+++ b/src/libpsl-native/arm.toolchain.cmake
@@ -1,7 +1,7 @@
 set(CMAKE_SYSTEM_NAME Linux)
 set(CMAKE_SYSTEM_VERSION 1)
 set(CMAKE_SYSTEM_PROCESSOR armv7l)
-set(CMAKE_CXX_COMPILER arm-linux-gnueabihf-g++ -fstack-protector-strong -fpie -DFORTIFY_SOURCE=2 -O2)
+set(CMAKE_CXX_COMPILER arm-linux-gnueabihf-g++ -fstack-protector-strong -fpie -D_FORTIFY_SOURCE=2)
 set(CMAKE_SHARED_LINKER_FLAGS "-Wl,-z,relro,-z,now")
 set(CMAKE_C_COMPILER arm-linux-gnueabihf-gcc)
 
diff --git a/src/libpsl-native/arm64.toolchain.cmake b/src/libpsl-native/arm64.toolchain.cmake
index 2bd02df..09a4d9d 100644
--- a/src/libpsl-native/arm64.toolchain.cmake
+++ b/src/libpsl-native/arm64.toolchain.cmake
@@ -1,7 +1,7 @@
 set(CMAKE_SYSTEM_NAME Linux)
 set(CMAKE_SYSTEM_VERSION 1)
 set(CMAKE_SYSTEM_PROCESSOR aarch64)
-set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++ -fstack-protector-strong -fpie -DFORTIFY_SOURCE=2 -O2)
+set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++ -fstack-protector-strong -fpie -D_FORTIFY_SOURCE=2)
 set(CMAKE_SHARED_LINKER_FLAGS "-Wl,-z,relro,-z,now")
 set(CMAKE_C_COMPILER aarch64-linux-gnu-gcc)
 
diff --git a/src/powershell-native/nativemsh/pwrshcommon/pwrshcommon.cpp b/src/powershell-native/nativemsh/pwrshcommon/pwrshcommon.cpp
index 67622f4..43b0f7f 100644
--- a/src/powershell-native/nativemsh/pwrshcommon/pwrshcommon.cpp
+++ b/src/powershell-native/nativemsh/pwrshcommon/pwrshcommon.cpp
@@ -668,12 +668,14 @@ namespace NativeMsh
     // NOTE: The names must not include the .dll extension because it will be added programmatically.
     static PCSTR trustedAssemblies[] =
     {
+        "getfilesiginforedistwrapper",
         "Markdig.Signed",
         "Microsoft.ApplicationInsights",
+        "Microsoft.Bcl.AsyncInterfaces",
         "Microsoft.CodeAnalysis",
         "Microsoft.CodeAnalysis.CSharp",
         "Microsoft.CSharp",
-        "Microsoft.DiaSymReader.Native.amd64",
+        "Microsoft.Extensions.ObjectPool",
         "Microsoft.Management.Infrastructure",
         "Microsoft.Management.Infrastructure.CimCmdlets",
         "Microsoft.Management.Infrastructure.Native",
@@ -698,7 +700,6 @@ namespace NativeMsh
         "netstandard",
         "Newtonsoft.Json",
         "NJsonSchema",
-        "PowerShell.Core.Instrumentation",
         "System",
         "System.AppContext",
         "System.Buffers",
@@ -730,6 +731,7 @@ namespace NativeMsh
         "System.Diagnostics.Debug",
         "System.Diagnostics.DiagnosticSource",
         "System.Diagnostics.EventLog",
+        "System.Diagnostics.EventLog.Messages",
         "System.Diagnostics.FileVersionInfo",
         "System.Diagnostics.PerformanceCounter",
         "System.Diagnostics.Process",
@@ -746,6 +748,7 @@ namespace NativeMsh
         "System.Drawing.Primitives",
         "System.Dynamic.Runtime",
         "System.Formats.Asn1",
+        "System.Formats.Tar",
         "System.Globalization",
         "System.Globalization.Calendars",
         "System.Globalization.Extensions",
@@ -774,7 +777,6 @@ namespace NativeMsh
         "System.Management.Automation",
         "System.Memory",
         "System.Net",
-        "System.Net.Connections",
         "System.Net.Http",
         "System.Net.Http.Json",
         "System.Net.Http.WinHttpHandler",
@@ -784,6 +786,7 @@ namespace NativeMsh
         "System.Net.NetworkInformation",
         "System.Net.Ping",
         "System.Net.Primitives",
+        "System.Net.Quic",
         "System.Net.Requests",
         "System.Net.Security",
         "System.Net.ServicePoint",
@@ -822,8 +825,8 @@ namespace NativeMsh
         "System.Runtime.Extensions",
         "System.Runtime.Handles",
         "System.Runtime.InteropServices",
+        "System.Runtime.InteropServices.JavaScript",
         "System.Runtime.InteropServices.RuntimeInformation",
-        "System.Runtime.InteropServices.WindowsRuntime",
         "System.Runtime.Intrinsics",
         "System.Runtime.Loader",
         "System.Runtime.Numerics",
@@ -860,6 +863,7 @@ namespace NativeMsh
         "System.ServiceModel.Web",
         "System.ServiceProcess",
         "System.ServiceProcess.ServiceController",
+        "System.Speech",
         "System.Text.Encoding",
         "System.Text.Encoding.CodePages",
         "System.Text.Encoding.Extensions",
@@ -882,9 +886,9 @@ namespace NativeMsh
         "System.ValueTuple",
         "System.Web",
         "System.Web.HttpUtility",
+        "System.Web.Services.Description",
         "System.Windows",
         "System.Windows.Extensions",
-        "System.Windows.Forms",
         "System.Xml",
         "System.Xml.Linq",
         "System.Xml.ReaderWriter",
diff --git a/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp b/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp
index d2e56e5..69068f3 100644
--- a/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp
+++ b/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp
@@ -39,6 +39,13 @@ unsigned int PowerShellCoreClrWorker::LaunchClr(
 {
     // Allocate a console so that the codepage is setup correctly
     AllocConsole();
+    HWND console = GetConsoleWindow();
+    if (console != NULL)
+    {
+        // Hide the console window
+        ShowWindow(console, SW_HIDE);
+    }
+
     return commonLib->LaunchCoreCLR(hostWrapper, hostEnvironment, friendlyName);
 }
 
diff --git a/tools/releaseBuild/images/Windows/Dockerfile b/tools/releaseBuild/images/Windows/Dockerfile
deleted file mode 100644
index 426f88e..0000000
--- a/tools/releaseBuild/images/Windows/Dockerfile
+++ /dev/null
@@ -1,3 +0,0 @@
-FROM arpatwar/microsoft.windowsservercore_build-tools:latest
-
-LABEL maintainer="PowerShell Team <powershellteam@hotmail.com>"
diff --git a/tools/releaseBuild/yaml/nuget.yml b/tools/releaseBuild/yaml/nuget.yml
index 3635da0..a45ec90 100644
--- a/tools/releaseBuild/yaml/nuget.yml
+++ b/tools/releaseBuild/yaml/nuget.yml
@@ -13,15 +13,6 @@ steps:
     targetPath: "$(System.ArtifactsDirectory)/signed"
   displayName: Download signed windows native packages
 
-- powershell: |
-    $null = New-Item $(PackageRoot) -ItemType Directory -Force -Verbose
-    if(-not (Test-Path '$(System.ArtifactsDirectory)/release' ))
-    {
-      New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)/release' -Force
-    }
-    Invoke-WebRequest -Uri '$(PSRPBlobUrl)' -OutFile $(System.ArtifactsDirectory)/release/psrp.zip -Verbose
-  displayName: 'Download PSRP package'
-
 - powershell: 'Get-ChildItem $(System.ArtifactsDirectory)/release'
   displayName: 'Capture downloaded zips'
 
@@ -80,9 +71,8 @@ steps:
    $LinuxARM64ZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'linux-arm64-symbols.zip'
    $LinuxAlpineZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'linux-musl-x64-symbols.zip'
    $macOSZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'osx-symbols.zip'
-   $psrpZipPath = Join-Path "$(System.ArtifactsDirectory)/release" 'psrp.zip'
 
-   Start-BuildPowerShellNativePackage -PackageRoot $PackageRoot -Version $(PackageVersion) -WindowsX64ZipPath  $WindowsX64ZipPath -WindowsX86ZipPath $WindowsX86ZipPath -WindowsARMZipPath $WindowsARMZipPath  -WindowsARM64ZipPath  $WindowsARM64ZipPath -LinuxZipPath $LinuxZipPath -LinuxARMZipPath  $LinuxARMZipPath -LinuxARM64ZipPath $LinuxARM64ZipPath -LinuxAlpineZipPath $LinuxAlpineZipPath -macOSZipPath $macOSZipPath -psrpZipPath $psrpZipPath
+   Start-BuildPowerShellNativePackage -PackageRoot $PackageRoot -Version $(PackageVersion) -WindowsX64ZipPath  $WindowsX64ZipPath -WindowsX86ZipPath $WindowsX86ZipPath -WindowsARMZipPath $WindowsARMZipPath  -WindowsARM64ZipPath  $WindowsARM64ZipPath -LinuxZipPath $LinuxZipPath -LinuxARMZipPath  $LinuxARMZipPath -LinuxARM64ZipPath $LinuxARM64ZipPath -LinuxAlpineZipPath $LinuxAlpineZipPath -macOSZipPath $macOSZipPath
 
   displayName: 'Collate NuGet package structure'
 
diff --git a/tools/releaseBuild/yaml/releaseBuild.yml b/tools/releaseBuild/yaml/releaseBuild.yml
index ae405ae..16e0161 100644
--- a/tools/releaseBuild/yaml/releaseBuild.yml
+++ b/tools/releaseBuild/yaml/releaseBuild.yml
@@ -7,7 +7,8 @@ variables:
     value: '$(System.ArtifactsDirectory)/NuGetRelease'
   - name: PackageRoot
     value: '$(System.ArtifactsDirectory)/Packages'
-  - group: PSNativeAPIScan
+  - group: ApiScan
+  - group: ApiScanMeta
   - group: SymbolPublish
   - group: Azure Blob variable group
 
@@ -182,15 +183,6 @@ stages:
         Get-ChildItem -Path 'ENV:'
       displayName: Capture environment
 
-    - powershell: |
-        $null = New-Item $(PackageRoot) -ItemType Directory -Force -Verbose
-        if(-not (Test-Path '$(Pipeline.Workspace)/release' ))
-        {
-          New-Item -ItemType Directory -Path '$(Pipeline.Workspace)/release' -Force
-        }
-        Invoke-WebRequest -Uri '$(PSRPBlobUrl)' -OutFile $(Pipeline.Workspace)/release/psrp.zip -Verbose
-      displayName: 'Download PSRP package'
-
     - powershell: 'Get-ChildItem $(Pipeline.Workspace)/release'
       displayName: 'Capture downloaded zips'