bobby_tablez

4 Followers
15 Following
20 Posts
Security researcher, gamer, tech e̷n̷t̷h̷u̷s̷i̷a̷s̷t̷ breaker

I just discovered an interesting #AMSI bypass which uses a massive amount of overlapping Unicode characters. Apparently if you append a few hundred before and after a known malicious command (such as an AMSI bypass, or "Invoke-Mimikatz"), AMSI either crashes or ignores the #PowerShell code in between the odd code blobs.

The best part is that the code doesn't even need to be obfuscated! Tested this on Windows 10/11 and Server installs with success.

Link to a gist with the bypass in the comments