AMSI Bypass

Question 1

What is AMSI?

Answer 1

A Windows security feature that scans scripts (like PowerShell) for malicious code before they run.

Question 2

Why bypass AMSI?

Answer 2

To run scripts (even legitimate ones) that might be flagged as malicious by AMSI’s detection rules.

Question 3

Patching AmsiScanBuffer

Answer 3

Modifying the AMSI function in memory to force it to always return “clean,” disabling scans.

Question 4

Obfuscation (3 methods)

Answer 4

String Splitting: “Inv” + “oke-Mimikatz”.

Base64: Encoding commands to hide them.

XOR: Encrypting strings to evade detection.

Question 5

Alternative Execution (3 methods)

Answer 5

CLR: Running .NET code in PowerShell.

C# via PowerShell: Compiling C# code dynamically.

Unmanaged DLLs: Loading external libraries not scanned by AMSI.

Question 6

What tool is often blocked by AMSI?

Answer 6

Mimikatz (used for credential dumping). Example: Invoke-Mimikatz.

Question 7

Why does patching AmsiScanBuffer work?

Answer 7

AMSI can’t scan scripts if its core function is broken in memory.

Question 8

Why does obfuscation evade detection?

Answer 8

AMSI looks for exact malicious strings. Obfuscation hides those strings.

Question 9

Why use unmanaged DLLs?

Answer 9

AMSI doesn’t scan code loaded from external DLLs, making them harder to detect.