logo
Red tradecraft
The invisible intruder: Evading real-time defences
  • Privacy greenhouse
  • Defence blues
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • An adversary mind map, one of many
    • The grounds
    • Ankh-Morpork: the city leaves a footprint
    • Fungolia earthworks
    • Unseen University Power & Light Co.
    • The Scarlet Semaphore
    • TryHackMe rooms
      • Smashing the stack in a browser tab
      • Where the raccoon learns which lids come off
      • Going unnoticed
        • Threading the needle: The raccoon’s art of process injection
        • Dancing with shadows: Outsmarting the digital watchdogs
        • The masked marauder: Cloaking intent in code
        • Breaking the mould: Evading digital fingerprints
        • Slipping past the gatekeeper: Bypassing user account control
        • The invisible intruder: Evading real-time defences
          • Study AMSI
          • PowerShell downgrade
          • PowerShell reflection
          • Patching AMSI
          • Automating, but …
        • The invisible intruder: Evading real-time defences
          • Study AMSI
          • PowerShell downgrade
          • PowerShell reflection
          • Patching AMSI
          • Automating, but …
        • Erasing the trail: Evading logging and monitoring
        • Urban survival: Using the environment against itself
        • Navigating the digital thicket: Evading network defences
        • Through the firebreak: Breaching digital barriers
        • Dodging the trap: Escaping the sandbox
      • Highway nut robbery: carrying data out
      • Fungal forays through the network
    • Root-Me challenges
    • RIPE NCC Academy labs

    The invisible intruder: Evading real-time defences¶

    Real-time detection mechanisms like AMSI and ETW are formidable foes. This section provides strategies to disable or evade these defences, ensuring your activities remain as unnoticed as a raccoon in the shadows.

    Runtime detection evasion

    • Study AMSI
    • PowerShell downgrade
    • PowerShell reflection
    • Patching AMSI
    • Automating, but …

    THM Room: Runtime Detection Evasion
    2026-07-30 17:57
    © Copyright 2025, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love by Ty Myrddin, 2026, with a forest garden fostered by /ut7