Skip to content

Latest commit

 

History

History
17 lines (12 loc) · 1.42 KB

ReadMe.md

File metadata and controls

17 lines (12 loc) · 1.42 KB

HideFromAMSI

HideFromAMSI is a simple C# example of how to Execute a PowerShell script from C# and Bypass AMSI using CyberArk's method to bypass AMSI.

This code doesn't open a PowerShell subprocess, but there are method that do, if you do open a PowerShell process, use the HookAmsiScanBuffer function before you decrypt the script. Moreover, in this code I used Mimikatz, but other scripts may need different code.

From what I've seen, it is better to open PowerShell (from C# using CreateOutOfProcessRunspace) as a subprocess and override that PowerShell's AMSI using HookAmsiScanBuffer (passing the PowerShellProcessInstance's handle to the hooking function).

For educational purposes only!