amsi

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

Analyse your malware to surgically obfuscate it

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup

Resources About Windows Security. 1100+ Open Source Tools. 3300+ Blog Post and Videos.

A PowerShell armoury for security guys and girls

JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses.

CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS.

Automated Tool That Generates The Perfect Meterpreter Powershell Payload

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

A C/C++ implementation of Microsoft's Antimalware Scan Interface

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

Exploring in-memory execution of .NET

Good CLR Host with Native patchless AMSI Bypass

The purpose of this tool is to test the window10 defender protection and also other antivirus protection.

HTTP Server serving obfuscated Powershell Scripts/Payloads

Miscellaneous Code and Docs

Patch AMSI and ETW in remote process via direct syscall

Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW

PowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA, entropy, string, and PE/imphash analysis. Companion to OffsetScan.