S3cur3Th1sSh1t/Amsi-Bypass-Powershell resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2190 stars · 331 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated collection of PowerShell scripts demonstrating various Antimalware Scan Interface (AMSI) bypass and avoidance techniques gathered from security blog posts. It serves as a reference for red teamers and security researchers testing Windows AMSI defenses.

Use cases

• bypass AMSI during penetration tests
• learn how AMSI evasion techniques work
• test endpoint detection against AMSI bypasses
• find a working AmsiScanBuffer patch technique
• study scriptblock smuggling and CLR hooking methods
• evaluate Windows antimalware logging bypasses

When to choose

• you are a red teamer needing a reference of AMSI bypass techniques
• you are researching Windows AMSI internals and evasion
• you want to test whether your EDR detects known AMSI bypasses

When to avoid

• you need production security tooling with support or a license
• you want guaranteed undetected bypasses - most scripts are signatured and need manual modification
• you are not working on Windows or with PowerShell

Facets

learning-resource · maturity maintenance

security penetration-testing security penetration-testing windows windows amsi-bypass powershell red-team offensive-security antimalware-scan-interface script-collection

Member repositories

For agents

markdown · JSON · MCP: product_card(name="S3cur3Th1sSh1t/Amsi-Bypass-Powershell")