• powershell Add-MpPreference -ExclusionPath [Path]
  • Exclude PATH from being scanned by the defender
  • Needs admin rights
• Obfuscation and detection preparation
  • https://github.com/danielbohannon/Invoke-Obfuscation → Obfuscate Powershell scripts for AMSI and AV bypass
  • https://amsi.fail/ → AMSI bypass
  • https://github.com/rasta-mouse/ThreatCheck/ → Check if binary or scripts (AMSI checks) are detected by AV