Kayıtlar

Mayıs, 2025 tarihine ait yayınlar gösteriliyor

New Amsi bypass 2025

  AMSI Bypass Techniques: Evading Windows Defender with Modern Methods Introduction Hello Microsoft team and fellow cybersecurity enthusiasts, In this post, I’ll walk you through the process of bypassing the Antimalware Scan Interface (AMSI) on Windows. We’ll explore traditional evasion methods, their limitations, and how modern, more sophisticated techniques—especially those implemented using a tool I developed called Micrasota —can be used to defeat AMSI and Windows Defender effectively. What is AMSI? AMSI is a Microsoft security feature designed to scan and block malicious code, especially scripts executed via PowerShell, CMD, WScript, or CScript. While powerful, AMSI has several design limitations that make it vulnerable to certain evasion techniques. Traditional Methods vs. Micrasota Old-school bypass techniques include: Code fragmentation Variable manipulation Instruction concatenation These methods were once effective but are now easily detected by Wind...

Defender bypass methot

Defender bypass methot: Command Execution via gatherNetworkInfo.vbs and Defender Bypass: A Technical Analysis 📅 Date: 19.02.2025 ✍️ Author: Eneshan Erdoğan Karaca 🎯 Topic: System32, Command Execution, Defender Dynamics, LOLBins 📂 Analyzed File: gatherNetworkInfo.vbs 🔍 Introduction Certain built-in script files in Windows are designed for system-related tasks. One such file, gatherNetworkInfo.vbs, is used to collect network information and resides in the System32 directory. This article provides a technical examination of the script’s structure, its command execution capabilities, and how Windows Defender approaches this file. 1️⃣ Command Execution Behavior in gatherNetworkInfo.vbs 🧠 Script Behavior The gatherNetworkInfo.vbs script utilizes the WScript.Shell object to perform command-line operations. For example, the script can be structured as follows: vbscript Set shell = CreateObject("WScript.Shell") shell.Run "cmd /c echo Hello World!" This setup allows sile...