amsi-bypass

AMSI Bypass

When to Use

• When operating on a Windows target during a Red Team engagement where PowerShell or .NET memory execution is required, but an EDR/AV is actively inspecting script contents via AMSI.
• To execute tools like Mimikatz, Rubeus, SharpHound, or BloodHound directly in memory without dropping detectable binaries to disk.
• When standard obfuscation fails because AMSI inspects content AFTER deobfuscation at the interpreter level.
• When needing to load custom .NET assemblies via Assembly.Load() which AMSI intercepts.

When NOT to use: If you need to bypass on-disk AV signature detection, use av-edr-evasion-techniques. For process injection after bypass, use process-hollowing.

Prerequisites

• Administrative or user-level access on a Windows target (AMSI bypass doesn't always require admin)
• PowerShell 5.1+ or PowerShell Core on the target
• Understanding of x86/x64 calling conventions for patching techniques
• For debugging: x64dbg or WinDbg for verifying patches

Workflow

Phase 1: Understanding AMSI Architecture

# Concept: AMSI (Antimalware Scan Interface) is a Windows API that allows applications
# to request AV scans of arbitrary content BEFORE it executes. 

# The scan flow:
# 1. User types PowerShell command → PowerShell.exe receives it
# 2. PowerShell calls AmsiScanBuffer() or AmsiScanString() in amsi.dll
# 3. amsi.dll forwards the content to registered AV providers (e.g., Defender)
# 4. AV returns AMSI_RESULT (Clean, Detected, etc.)
# 5. If Detected → PowerShell blocks execution with an error

# Key DLL functions in amsi.dll:
# - AmsiInitialize()     → Creates AMSI context for the application
# - AmsiOpenSession()    → Opens a scan session
# - AmsiScanBuffer()     → Scans raw byte buffer (PRIMARY TARGET)
# - AmsiScanString()     → Scans string content
# - AmsiCloseSession()   → Closes session
# - AmsiUninitialize()   → Destroys AMSI context

# Attack surface: If we corrupt AmsiScanBuffer() or AmsiOpenSession(),
# ALL subsequent scans return "clean" regardless of actual content.