LightsOut – Generate An Obfuscated DLL That Will Disable AMSI And ETW
0 comments
LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor
Or even easier, copy powershell to an arbitrary location and side load the DLL!
Greetz/Credit/Further Reference:
- @RastaMouse for their blog post on patching AMSI: https://rastamouse.me/memory-patching-amsi-bypass/
- @CCob/EthicalChaos for their blog post on patchless AMSI bypasses via hardware breakpoints: https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/
- @rad9800 for their code which this tool uses to bypass AMSI and ETW with hardware breakpoints: https://github.com/rad9800/misc/tree/main/hooks
Download LightsOut
Share:
Warning: Trying to access array offset on value of type bool in /home/u349216201/domains/esystematics.com/public_html/blog/wp-content/plugins/bridge-core/modules/shortcodes/shortcode-elements/_social-share-list/templates/social-share-list.php on line 104
