Hej Shellsec

Der er sjældent diskussioner om tekniske emner herinde, men nu prøver jeg alligevel.
Powershell Empire's stagers bliver opsnappet af windows defender gennem AMSI, hvad jeg kan lurer mig frem til kører den stadig AMSIScanString og ikke kun AMSIScanBuffer, som jeg ellers havde formodet var lukket af Microsoft.

Jeg mener at jeg kan bypasse AMSIScanBuffer, men jeg har problemer med AMSIScanString. Hvilke obfuskeringsmetoder kender i til, som omgår windows defender AMSI på en fuldt patched windows 10?

Jeg prøver at lege lidt med Invoke-Obfuscation, dog uden held indtil vidre.
Nuværende Invoke-Obfuscation streng er "Token\All\1,Encoding\1,Launcher\STDIN++\234"

Citer:Another method is to disable AMSI with the PowerShell cmdlet Set-MpPreference; for example, as Nikhil Mittal explains in his presentation AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It. This disables Windows Defender’s real-time detection, an operation that requires administrator rights.
The command
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
disables AMSI for the current process. The AMSI bypass was discovered by Matt Graeber and does not require any administrative rights. In both cases, the executed operation or the deactivation is detected by monitoring the PowerShell and event logs.

https://www.scip.ch/en/?labs.20180111