Rasta Mouse Brain Farts
Blog / June 6, 2021 / Rasta Mouse
This is the first in a short series of posts designed to explore common (remote) process injection techniques and their OPSEC considerations. Each part will introduce a different technique that will address one or more “weaknesses” previously identified. This post will analyse the most classical method of injection – the VirtualAllocEx/WriteProcessMemory/CreateRemoteThread pattern; and assumes the
Blog / June 4, 2021 / Rasta Mouse
In the Memory Patching AMSI Bypass post, I discussed how to patch the AmsiScanBuffer function to prevent it from returning a positive result when scanning content. That process involved: Finding the location of AmsiScanBuffer in memory. Changing the memory permissions to RWX. Copying the patched bytes across. Restoring the memory region back to RX. After
Blog / June 3, 2021 / Rasta Mouse
This post is a replacement for my previous 4-part series. What is AMSI? The Antimalware Scan Interface is a set of Windows APIs that allows any application to integrate with an antivirus product (assuming that product acts as an AMSI provider). Windows Defender, naturally, acts as an AMSI provider as do many third-party AV solutions.