PSAmsi - An Offensive PowerShell Module for Interacting with the Anti Malware Scan Interface

PSAmsi - An Offensive PowerShell Module for Interacting with the Anti Malware Scan Interface

Explore an offensive PowerShell module for interacting with the Anti-Malware Scan Interface in Windows through this 42-minute Derbycon 7 conference talk. Delve into the continued relevance of offensive PowerShell, the workings of PSAmsi, and techniques for signature detection and obfuscation. Learn about automating the obfuscation process, client-server architecture for evasion, and evolving strategies. Gain insights into the PSAmsi scanner class, finding MSI signatures, and implementing obfuscation examples. Discover how to leverage Group Policy and understand the implications for offensive security operations.