AMSI-WRITE-RAID-BYPASS - "AMSI WRITE RAID" Vulnerability that leads to an e

项目说明

One liner Signature Bypass for the AMSI WRITE RAID BYPASS

✅ Undetected => More info in A Folder

__AMSI WRITE RAID

This is a discovery for bypassing Antimalware Scan Interface (AMSI) and I will call it AMSI Write Raid, I mean why not?

Usually all the memory addresses pointing to the functions and data within the DLLs that the program depends on are inside the import address table (IAT) and they are marked as read only, so whenever you want to tamper with them, you have to use api to mark the page as writable first.

And so EDR's will monitor the API to see if the API call is doing something suspicious or not.

But strangely, I discovered a writable entry that you can o without the need of API, that can bypass the whole AMSI process.

And because I am not using API to change the memory protection, as it is already marked as Read/Write, it will likely bypass AV's and EDR's.

Note: Most AV's supports and uses the AMSI functionality de by Microsoft, so bypassing AMSI => Bypasses not only defender but all of them.

Tested on win11 Build 22631 (Latest at the time of writing) and windows Preview.

Update 14/05/2024

I wanted to mention that this was not the only writable entry that you can o to bypass AMSI with the same concept. I disovered that most of the highlighed entries (.png) in the call stack image below are as well to the same discussed in the paper / blog (writable_entries_part_1.png). The entries are not write protected, so o any of the call pointers would bypass Amsi as well.

! Entries

!Writable Entries

Update 28/10/2024

This POC is still working, but it is signatured by Defender after being published for some time.

A simple trick To bypass Signature => is to split the script to different files and call them 1 by 1 :)

Something like this:

CLR.DLL ###

After using the POC.ps1, if you try to load rubeus for example, you will get blocked by AMSI, e the error is a bit confusing but this is because of AMSI.

!CLR Error

You have to do the same analysis that I did, and your starting point is always amsi!AmsiScanBuffer.

!CLR Entries

!CLR Writable Entry

The call __guard_dispatch_icall_fptr__ is added as part of a security feature that was created to combat memory corruption . By placing tight restrictions on where an application can execute code from, it makes it much harder for exploits to execute arbitrary code through such as buffer o. that security feature is called __Control Flow Guard__.

_CFG Call_ will take the value inside rax which is the location of _AmsiScanBuffer_ pointer and it using a set of bitmaps if that address is allowed to run or not and then call it (if allowed).

while __Control Flow Guard (CFG)__ is outside the scope of this blog, it will not concern us, as we are not changing the location of the pointer that is being called, so we will not be triggering CFG.

The Full Bypass:

!CLR Bypass POC

I will not publish the POC for clr.dll, I will keep it as an exercise :)

项目信息

开发语言：PowerShell

Star 数：336

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。