Defense Evasion (AMSI / AV / EDR)

Getting execution is only half of it: a modern Windows has three layers watching. AMSI inspects scripts (PowerShell, VBA, JScript) right before they run; the AV (Defender) scans files and behavior with signatures and heuristics; the EDR hooks calls (user-land hooks, ETW, kernel callbacks) to see what your process does in real time. Evasion means making your code unseen, unrecognized, or not understood by each layer.

Threat model

Each layer has a blind spot. AMSI runs inside your own process → neutralize it in memory and it sees nothing. The AV relies on signatures → change the signature (obfuscate) and it doesn’t recognize the bytes. The EDR hooks user-land APIs → avoid those APIs or undo the hook and it loses visibility. Evasion isn’t magic: it’s knowing where each defense looks and going through the gap.

Red Team

AMSI

AMSI is the priority when using in-memory PowerShell/.NET. Vectors:

• In-memory patch of AmsiScanBuffer: patch the function in amsi.dll inside your process so it always returns “clean” (AMSI_RESULT_CLEAN). The dominant method.
• Break initialization (amsiInitFailed) so scanning never starts.
• Obfuscate/fragment the script so the signature doesn’t match (rename variables, concatenate strings, encode).
• Use a .NET runspace that doesn’t load AMSI, or versions/hosts without AMSI.

# conceptual pattern (not a paste-ready signature):
# 1) locate amsi.dll!AmsiScanBuffer in the process
# 2) change memory protection (VirtualProtect) to RWX
# 3) write a stub returning E_INVALIDARG / CLEAN
# 4) restore protection

AV (signatures)

• Obfuscation of payloads (packers, encryption, renaming) to break static signatures.
• Encrypted shellcode decrypted only at runtime; avoid touching disk (in-memory execution).
• Sign binaries, use LOLBins (legitimate OS binaries) so you introduce no executables of your own.

EDR (hooks, ETW, telemetry)

• Unhooking: restore the original bytes of ntdll.dll (reload a clean copy from disk) to remove the EDR’s user-land hooks.
• Direct syscalls / indirect syscalls (Hell’s Gate, Halo’s Gate, SysWhispers): invoke syscalls bypassing the hooked APIs.
• ETW patching: patch EtwEventWrite to blind .NET/PowerShell telemetry.
• Stealthy process injection (process hollowing, module stomping, APC) and BYOVD to kill the EDR from the kernel.
• Living off the land: minimize your own binaries; use rundll32, regsvr32, mshta, wmic, msbuild (LOLBins) and fileless loads.

Execution Policy (not security)

The PowerShell Execution Policy is not a security control; it’s trivially bypassed (-ep bypass, -enc, pipe via stdin, read and IEX). It doesn’t count as real evasion, but it’s worth knowing.

Tools

• AMSI.fail, amsi-bypass scripts, Invoke-Obfuscation — AMSI and obfuscation.
• ScareCrow, Donut, Freeze, NimPackt — evasive loader/shellcode generation.
• SysWhispers2/3, Hell’s Gate/Halo’s Gate — direct/indirect syscalls.
• SharpUnhooker, ThreatCheck, DefenderCheck — unhooking and finding which byte trips the signature.

Impact

Run offensive tools (mimikatz, Rubeus, BloodHound) without AV/EDR detection, keep C2 stable, and blind the telemetry that would expose the intrusion. It’s an enabler of everything else in post-exploitation.

Blue Team

Detection

• AMSI bypass patterns (access to amsi.dll, VirtualProtect over AmsiScanBuffer) and ETW patching (EtwEventWrite).
• Unhooking: reads of ntdll.dll from disk and rewriting its .text in memory.
• Direct syscalls (calls not passing the expected hooks), process injection (CreateRemoteThread, APC, hollowing).
• LOLBin use with anomalous command lines; fileless loads.

Telemetry

• Script Block Logging (4104) captures the script after deobfuscation → key against obfuscated PowerShell.
• ETW (Threat Intelligence provider, kernel callbacks) resists some user-land tampering.
• Sysmon 7 (image load of amsi.dll/clr.dll), 8 (CreateRemoteThread), 10 (process access), 25 (process tampering).

Hardening

• Defender ASR rules, Credential Guard, HVCI, and WDAC/AppLocker (allowlist cuts LOLBins and loaders).
• PowerShell Constrained Language Mode + Script Block Logging + transcription.
• Microsoft Driver Blocklist against BYOVD; EDR with anti-tamper protection.
• Keep defenses in the kernel (ETW-TI, callbacks) where user-land tampering can’t reach; segment and limit which hosts run scripts.

Response

If evasion is detected, assume the EDR may have been blind for a while: hunt out-of-band (network telemetry, centralized logs), rebuild the host, rotate credentials, and review persistence the EDR missed.

CVEs and real-world cases

• AMSI/ETW patching and unhooking are standard red-team and APT TTPs (MITRE T1562.001 Impair Defenses, T1055 Process Injection, T1620 Reflective Loading).
• BYOVD to kill EDR: campaigns by BlackByte, LockBit, Scattered Spider using signed vulnerable drivers.
• CVE-2021-21551 (Dell dbutil) and RTCore64 (MSI Afterburner) among the most abused drivers to disable defenses.
• Defender has hardened AMSI repeatedly; bypasses live in a constant patch-evasion cycle.

Testing checklist

• Is AMSI active? Does an in-memory bypass (AmsiScanBuffer) work?
• Does the obfuscated/encrypted payload evade static signatures? (ThreatCheck)
• Does the EDR hook user-land? Do unhooking or direct syscalls evade it?
• Does ETW patching blind .NET/PowerShell telemetry?
• Can you operate fileless / with LOLBins without introducing binaries?
• Is there a loadable vulnerable driver (BYOVD) to down the EDR?
• Blue: does Script Block Logging capture the deobfuscated script?
• Are ASR/WDAC/Constrained Language Mode enabled?

References

• HackTricks — Av bypass
• MITRE ATT&CK — 001
• Amsi-Bypass-Powershell — S3cur3Th1sSh1t (GitHub)
• LOLBAS — abusable living-off-the-land Windows binaries