Advanced Antivirus Evasion
In a previous module, we demonstrated basic antivirus bypasses.
We obfuscated sections of code that contained potential signatures
and wrote simple logic tests that could detect emulation engines.
Detection routines built into locally-installed antivirus clients
have access to limited processing power
and are hampered by time constraints,
since users will not tolerate lengthy scans that consume too many resources.
To combat this, some antivirus vendors rely on cloud-based resources
and try to use artificial intelligence (AI) to detect malicious behavior.
The topic of evading cloud AI and the very sophisticated Endpoint Detection
and Response security suites are beyond the scope of this module,
but we can build on our work from the previous module.
For example, we didn’t use any evasion actions in our PowerShell code
and yet it was not detected.
This is because we purposely downloaded and executed the code directly in memory
without giving the antivirus a chance to scan it.
Microsoft addressed this gap with the Antimalware Scan Interface (A.M.S.I.),
introduced in Windows 10.
A.M.S.I. is essentially a set of APIs that allow antivirus products to scan
PowerShell commands and scripts when they are executed,
even if they are never written to disk.
In recent years, many antivirus products
(including Microsoft’s own Windows Defender Antivirus)
have begun to rely on AMSI to detect more advanced malicious activity.
In this module, we’ll explore the impact of
Windows Defender’s implementation of AMSI on PowerShell and Jscript.
However, in order to do this, we must inspect the code at the assembly level.
To that end, we’ll begin with an overview of assembly
and then discuss the process of viewing code execution
through the Windows Debugger.