logo
Red wilds
The invisible intruder: Evading real-time defences
  • Privacy greenhouse
  • Defence blues
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • Unseen University Power & Light Co.
    • The Scarlet Semaphore
    • Myrddin’s menagerie
    • In: Where the falcons and foxes roam
    • Through: Where the raccoons burrow and rummage
      • The art of staying where you are not wanted
      • Overflowing the bin on purpose
      • Reverse engineering
      • Steganography
      • Crypto-attacks
      • Slipping through the cracks
        • Plausible notes
        • Runbooks
        • Playbooks
        • Practise makes untraceable
          • Threading the needle: The raccoon’s art of process injection
          • Dancing with shadows: Outsmarting the digital watchdogs
          • The masked marauder: Cloaking intent in code
          • Breaking the mould: Evading digital fingerprints
          • Slipping past the gatekeeper: Bypassing user account control
          • The invisible intruder: Evading real-time defences
            • Study AMSI
            • PowerShell downgrade
            • PowerShell reflection
            • Patching AMSI
            • Automating, but …
          • The invisible intruder: Evading real-time defences
            • Study AMSI
            • PowerShell downgrade
            • PowerShell reflection
            • Patching AMSI
            • Automating, but …
          • Erasing the trail: Evading logging and monitoring
          • Urban survival: Using the environment against itself
          • Navigating the digital thicket: Evading network defences
          • Through the firebreak: Breaching digital barriers
          • Dodging the trap: Escaping the sandbox
    • Out: Where squirrels swipe the crown jewels

    The invisible intruder: Evading real-time defences¶

    Real-time detection mechanisms like AMSI and ETW are formidable foes. This section provides strategies to disable or evade these defences, ensuring your activities remain as unnoticed as a raccoon in the shadows.

    Runtime detection evasion

    • Study AMSI
    • PowerShell downgrade
    • PowerShell reflection
    • Patching AMSI
    • Automating, but …

    THM Room: Runtime Detection Evasion
    2026-03-25 22:33
    © Copyright 2025, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love in the Unseen University, 2025, with a forest garden fostered by /ut7