AMSI & Bypass: Review of Known AMSI Bypass Techniques and Introducing a New One
summary
Claims a new, undocumented AMSI bypass that modifies provider code instead of amsi.dll, implemented as PowerShell PoCs that locate provider vtables, change page protections and overwrite the provider's scan/GetClassObject bytes so scans return benign results. It uses patching provider DLLs and uninitialize via reflection to force reinitialization and trigger the patched code, successfully running Invoke-Mimikatz in demos. Countermeasures suggested include protecting provider memory pages and monitoring unexpected page-protection changes or context reinitialization.
AI-written summary · about
chapters (16)
- 0:00Start
- 3:43Process Memory Layout
- 5:48Attack Surface
- 7:17Disabling AMSI
- 10:36What can Security Vendors do?
- 11:25AMSI.DLL code patching
- 12:58AMSI Context structure patching
- 13:52What Security Vendors are doing?
- 14:27Better Approach of security vendors
- 16:40COM Server Hijacking
- 17:03More AMSI Bypass Techniques
- 18:40AMSI Initialization
- 25:521st Bypass Script
- 30:22Finding The Providers' Scan Function
- 32:222nd Bypass Script - 32bit
- 36:37Takeaways
related talks
47mAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
53mInside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques
51mSneaking Past Device Guard
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
26mBridging the Gap Between Research and Practice in Intelligently Bypassing WAF
50mWrite Once, Pwn Anywhere
41mSimulation Hacking, the Good, Bad and the Ugly
48m"Sneaking Past Device Guard"