In-memory AMSI bypass attempt

evasion_amsi_bypass_attempt

Runs the published AMSI bypass one-liner in PowerShell and then feeds AMSI's own test string through Invoke-Expression, to establish whether script scanning can be switched off from inside a script. Nothing is written and no machine state changes.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 1 Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1059.001	PowerShell	Execution	coverage statistics
T1562.001	Disable or Modify Tools	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other defence evasion tests

Other tests in the Defence evasion category.
Test	What it does	Severity
Adding a Defender exclusion path evasion_defender_exclusion	Adds the sandbox directory to Microsoft Defender's exclusion list, verifies whether it took effect, and removes it again. Adding an exclusion is how c…	critical
Disabling Defender real-time monitoring evasion_defender_realtime_disable	Attempts to turn off Microsoft Defender's real-time monitoring through Set-MpPreference and turns it back on again. With tamper protection enabled thi…	critical
Stopping security services evasion_security_service_stop	Identifies which EDR/AV/telemetry services are actually running on this host and attempts to stop up to three of them, then restarts them. Tamper prot…	critical
Clearing an event log evasion_event_log_clear	Clears the Windows Application event log, which is the anti-forensic step that follows a successful intrusion and raises event 1102. This cannot be un…	high
Disabling the host firewall evasion_firewall_disable	Turns the host firewall off and immediately back on, using the platform's own tool (netsh advfirewall, socketfilterfw, ufw or firewalld). The re-enabl…	high
Timestomping a file evasion_timestomp	Backdates the modification and access times of a sandbox file to 2009 and verifies the change, the standard anti-forensic step for making a dropped fi…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.