Introduction

THM Room: Runtime Detection Evasion

What?

Bypass common runtime detection measures, such as AMSI, using modern tool-agnostic approaches.

Why?

Overcoming headaches and roadblocks when executing malicious code.

How?

• Study AMSI

• PowerShell downgrade

• PowerShell reflection

• Patching AMSI

• Automating, but …