amsi 开源项目推荐（73 个）

tokyoneon /Chimera

Chimera是一个PowerShell混淆脚本，旨在绕过AMSI和商业防病毒解决方案。

dobin /avred

Analyse your malware to surgically obfuscate it

mgeeky /Stracciatella

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup

alphaSeclab /windows-security

Resources About Windows Security. 1100+ Open Source Tools. 3300+ Blog Post and Videos.

cfalta /PowerShellArmoury

A PowerShell armoury for security guys and girls

sinfulz /JustEvadeBro

JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses.

tokyoneon /CredPhish

CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS.

GetRektBoy724 /MeterPwrShell

Automated Tool That Generates The Perfect Meterpreter Powershell Payload

GetRektBoy724 /BetterXencrypt

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

atxsinn3r /amsiscanner

A C/C++ implementation of Microsoft's Antimalware Scan Interface

ScriptIdiot /BOF-patchit

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

mez-0 /InMemoryNET

Exploring in-memory execution of .NET

almounah /go-buena-clr

Good CLR Host with Native patchless AMSI Bypass

machine1337 /window-rat

The purpose of this tool is to test the window10 defender protection and also other antivirus protection.

safebuffer /LightMe

HTTP Server serving obfuscated Powershell Scripts/Payloads

hfiref0x /Misc

Miscellaneous Code and Docs

Hagrid29 /RemotePatcher

Patch AMSI and ETW in remote process via direct syscall

ScriptIdiot /sleepmask_PatchlessHook

Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW

warpedatom /OffsetInspect

PowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA, entropy, string, and PE/imphash analysis. Companion to OffsetScan.

NewOrbit /MalwareScan.AMSI

该项目在 GitHub 上没有填写描述