AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
summary
Windows 10’s AMSI inspects clear-text scripts submitted to the scripting host and Windows Defender blocks in-memory attacks in demos, including detection of Invoke-Mimikatz.ps1 pulled via DownloadString; demo shows AMSI toggled with Set-MpPreference and IOAVProtection. Bypasses demonstrated include simple obfuscation via ISE/Steroids, running legacy PowerShell v2 fallback, unloading AMSI from the current process, and DLL-planting by running powershell.exe from a crafted directory; PowerShell v5’s automatic scriptblock logging often leaves the forensic trace even when AMSI is avoided.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:54Welcome
- 1:04About Me
- 2:11Agenda
- 3:06ScriptBased Attacks
- 7:15How do we use it
- 9:42How does it work
- 14:28Demonstration
- 18:44What if
- 19:49Unusual Execution
- 20:59Detection
- 23:51Manual Obfuscation
- 33:20SetMP Preference
- 39:51Clientside Attack
- 40:21Metasploit Attack
- 44:39Conclusion
related talks
01h 40mDefending against PowerShell attacks - in theory, and in practice
39mAMSI & Bypass: Review of Known AMSI Bypass Techniques and Introducing a New One
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
25mInvestigating PowerShell Attacks
53mInside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
58mRed Team Techniques for Evading, Bypassing & Disabling MS
48mStop Writing Insecure PowerShell... Seriously.