Skip to content

Bypass AMSI and Executing PowerShell scripts from C# - using CyberArk's method to bypass AMSI

Notifications You must be signed in to change notification settings

csharpHub/HideFromAMSI

 
 

Repository files navigation

HideFromAMSI

HideFromAMSI is a simple C# example of how to Execute a PowerShell script from C# and Bypass AMSI using CyberArk's method to bypass AMSI.

This code doesn't open a PowerShell subprocess, but there are method that do, if you do open a PowerShell process, use the HookAmsiScanBuffer function before you decrypt the script. Moreover, in this code I used Mimikatz, but other scripts may need different code.

From what I've seen, it is better to open PowerShell (from C# using CreateOutOfProcessRunspace) as a subprocess and override that PowerShell's AMSI using HookAmsiScanBuffer (passing the PowerShellProcessInstance's handle to the hooking function).

For educational purposes only!

About

Bypass AMSI and Executing PowerShell scripts from C# - using CyberArk's method to bypass AMSI

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C# 100.0%