rootkit-io / AMS-BP

AMSI Bypass for powershell

AMS-BP

Bypass Powershell AMSI using a simple script. This Script is comprised of a DLL (source file included) which when loaded and executed will disable AmsiScanString. This DLL is based on CyberArk Post with some minor changes to defeat Windows Defender and AMSI itself which now recognizes the strings inside the DLL when it is loaded.

Usage:

Using the DLL

PS C:\> [Reflection.Assembly]::Load([IO.File]::ReadAllBytes("$pwd\\Source.dll"))
PS C:\> [BP.AMS]::Disable()

Using the .ps1 script

PS C:\> Import-Module .\AMSBP.ps1
PS C:\> AMSBP