UAC Bypass vs Microsoft Defender
In this section, we’ll walk through a case study
in which we must execute PowerShell in a new process and evade AMSI.
This case study leverages a UAC bypass that abuses the Fodhelper.exe application.
This particular UAC bypass still works
on the most recent Windows version at the time of this video
and does not rely on writing a file to disk.
First, we’ll briefly cover the internals of the bypass
and determine how it fares against AMSI.