logo
Red team
The invisible intruder: Evading real-time defences
  • Green team
  • Blue team
  • Purple team
  • Indigo team
  • Broomstick Brief
  • Ty Myrddin
Initializing search
      • IN: Where the falcons and foxes roam
      • THROUGH: Where the raccoons burrow and rummage
        • The art of staying where you are not wanted
        • Where the raccoon overflows the bin—on purpose
        • Foraging for secrets in binaries
        • The payload is in the picnic photo
        • Tipping the stack—and the garbage can
        • Nature’s cheats: The raccoon’s guide to slipping through the cracks
          • Slippery paws: Practise makes untraceable
            • Threading the needle: The raccoon’s art of process injection
            • Dancing with shadows: Outsmarting the digital watchdogs
            • The masked marauder: Cloaking intent in code
            • Breaking the mould: Evading digital fingerprints
            • Slipping past the gatekeeper: Bypassing user account control
            • The invisible intruder: Evading real-time defences
              • Study AMSI
              • PowerShell downgrade
              • PowerShell reflection
              • Patching AMSI
              • Automating, but …
            • The invisible intruder: Evading real-time defences
              • Study AMSI
              • PowerShell downgrade
              • PowerShell reflection
              • Patching AMSI
              • Automating, but …
            • Erasing the trail: Evading logging and monitoring
            • Urban survival: Using the environment against itself
            • Navigating the digital thicket: Evading network defences
            • Through the firebreak: Breaching digital barriers
            • Dodging the trap: Escaping the sandbox
      • OUT: Where squirrels swipe the crown jewels

    The invisible intruder: Evading real-time defences¶

    Real-time detection mechanisms like AMSI and ETW are formidable foes. This section provides strategies to disable or evade these defences, ensuring your activities remain as unnoticed as a raccoon in the shadows.

    Runtime detection evasion

    • Study AMSI
    • PowerShell downgrade
    • PowerShell reflection
    • Patching AMSI
    • Automating, but …

    THM Room: Runtime Detection Evasion
    Last update: 2025-05-19 17:27
    Back to top
    Previous Automated exploitation
    Next Study AMSI
    © Copyright 2025, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love in the Unseen University, 2025, with a forest garden fostered by /ut7