Red Team Tips: May 5th 2023 AMSI Killer AMSI Patch

[@thewifiaddict]

Thanks for the great content! It helps alot!

[@CyberAttackDefense]

Thanks for watching!

[@hisham-pq3xc]

thx , i will try it

[@CyberAttackDefense]

Have fun

[@firos5381]

thankks could u maybe do a few vedios on payload modification to bypass av solutions

[@CyberAttackDefense]

I have a couple already take a look at some of my older videos

[@kieferl1586]

Very good watch. Do you do any malware development?

[@CyberAttackDefense]

A little bit. I’m not great at it yet but getting better.

[@novianindy887]

so anyways we still have to drop the exe of Amsi Killer and execute it? it will be blocked by smartScreen too yes? bcoz it's unsigned. If we still want to attack via powershell , is the obfuscation enough to prevent Amsi?

[@CyberAttackDefense]

Yes obfuscation can beat Amsi

[@novianindy887]

@@CyberAttackDefense what are ways to execute powershell with a click, besides known ones like .lnk file? We cant expect someone to right click a .ps1 file and click run , right?

[@CyberAttackDefense]

@@novianindy887 Macros used to be the best way now Microsoft is killing those off. ISOs with hidden files like lnk is what I still see.

[@shayarand]

Thanks again for the great content! Can you make a video of how to approach a domain thats using zscaler and common sharepoint misconfigurations?

[@CyberAttackDefense]

Great suggestion! I don’t have zscaler but maybe sharepoint