Bypassing Applocker+AMSI+Defender in 2024
Introduction Malware development and EDR/AV evasion is a constant cat and mouse game. Evasion techniques are discovered, popularized, and then shortly detected. This is a combination of several techniques learned while taking Offsec’s Offensive Security Experienced Professional (OSEP) course. As of July 2024, this method will successfully run Malicious PowerShell on a fully patched Windows system with Applocker, AMSI, Constrained Language Mode (CLM), and Defender. PowerShell can then be used to perform recon like WinPEAS.
