Attacking Initialization
In the previous section, we evaded AMSI by corrupting the context structure.
This context structure is created by the AmsiInitialize function
when AMSI.DLL is first loaded and initialized inside the PowerShell process.
Manipulating a result variable set by AmsiInitialize can also lead to another
AMSI bypass through the amsiInitFailed field,
a technique first discovered by Matt Graeber in 2016.
The amsiInitFailed field is verified by AmsiOpenSession
in the same manner as the amsiContext header, which leads to an error.
The AMSI bypass still works even though it was discovered in 2016,
but the substrings ‘AmsiUtils’ and ‘amsiInitFailed’
have since been flagged as malicious.
We can reuse the dynamic discovery of types and fields from our
amsiContext AMSI bypass to evade the signatures and reuse this bypass.
Both AMSI bypasses rely on reflection, but as we’ll discuss in the next section,
we can also use the Win32 APIs to corrupt the AMSI functions themselves.