Philippe Vogler

Resurrecting an old AMSI Bypass

24 June 2020 ~8 min By Philippe Vogler
Amsi Bypass Powershell
While working on DoubleAgent as part of the Introduction To Red Teaming course we’re developing for RingZer0, I had a look at Anti-Malware Scan Interface (AMSI) bypasses. One of the objectives I had was to find a new way to evade AMSI. As with my DoubleAgent work, this did not lead to the identification of a novel finding, but instead revealed that old techniques can be revived with minimal work.…

Masquerading Windows processes like a DoubleAgent.

23 April 2020 ~13 min By Philippe Vogler
Anti-Virus Malware Persistence Post-Exploitation Sysmon Windows
I’ve been spending some time building new content for our Introduction to Red Teaming course, which has been great for diving into AV/EDR bypass techniques again. In this blog post, I will demonstrate how to re-weaponise the old “DoubleAgent” technique, making endpoint security products do the hacking work for us. One known vector to shimmy past AV solutions is to use process injections. At BlackHat 2019, a number of process…