A few weeks ago, there was a post in another sub-reddit asking for any suggestions on how to get their payloads past the anti-malware scan interface and Windows defender. This problem has definitely become more challenging overtime, and has forced me to write new AMSI bypasses. My goal with this post is to give a concrete example of selecting a set of bypasses and applying tailored obfuscation to evade AV and bypass defenses.
Please let me know if you find this post helpful. Let me know if there’s anything I can do to improve!
Click to Open Code Editor