Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 943709" data-attributes="member: 32260">I did it as follows:<ol>
<li data-xf-list-type="ol">Run PowerShell console and execute the command: 
Invoke-MimiKatz</li>
<li data-xf-list-type="ol">The command should trigger the red alert: 
&quot;This script contains malicious content and has been blocked by your antivirus software.&quot; 
This is a sign that AMSI works.</li>
<li data-xf-list-type="ol">Copy/paste the content of any script with AMSI bypass to the PowerShell console and try to execute it. You will see the red alert related to Constrained Language Mode: 
&quot;Cannot invoke method. Method invocation is supported only on core types in this language mode.&quot;</li>
<li data-xf-list-type="ol">If you see the alert from point 2 instead, then it is a sign that the code from AMSI bypass was detected by Defender. If you will disable the Defender real-time protection, then you will see the alert from the point 3.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 943709, member: 32260"] I did it as follows: [LIST=1] [*]Run PowerShell console and execute the command: Invoke-MimiKatz [*]The command should trigger the red alert: "[B][COLOR=rgb(184, 49, 47)]This script contains malicious content and has been blocked by your antivirus software.[/COLOR][/B]" This is a sign that AMSI works. [*]Copy/paste the content of any script with AMSI bypass to the PowerShell console and try to execute it. You will see the red alert related to Constrained Language Mode: "[B][COLOR=rgb(184, 49, 47)]Cannot invoke method. Method invocation is supported only on core types in this language mode.[/COLOR][/B]" [*]If you see the alert from point 2 instead, then it is a sign that the code from AMSI bypass was detected by Defender. If you will disable the Defender real-time protection, then you will see the alert from the point 3. [/LIST] [/QUOTE]

Verification