Skip to content

Latest commit

 

History

History
 
 

FakeAMSI

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 

Technically, AMSI is a set of DLLs being asked for a buffer evaluation (saying it's safe/unsafe). It means, processes (such as powershell.exe) load such DLLs when want to use AMSI. And it sounds like perfect opportunity to misuse such DLL as a method of persistence.

Registering with Regsvr32.exe FakeAMSI.dll, unregistering with Regsvr32.exe /u FakeAMSI.dll

DebugView for displaying the effect - user name and process name.