⛓ Divide and Rule — AMSI Bypass

By spliiting well known PowerShell scripts, e.g. an AMSI Bypass, we can directly bypass Windows Defender or get at least the line, where the detection occurs. Outcome: Several AMSI Bypasses and two scripts:

- One to split PowerShell snippets in multiple lines
- A second script to run all the files in an Oneliner, XOR obfuscated

https://badoption.eu/blog/2023/07/15/divideconqer.html

#amsi #av #bypass #powershell

⚡PsMapExec

A PowerShell tool that takes strong inspiration from CrackMapExec.

🚀 Supported Methods

— PsExec
— RDP
— SMB Signing
— WinRM
— WMI

🔗 More Detailed
🔗 Github Repository

#ad #windows #powershell #cme