WD Detection (Win32/Amadey.Z!MTB) Powershell command.

[milllzea006-a11y]

Hello, how to get rid of this detection? loading the installer with runpe but still triggering this detection. is this some AMSI thing?

[wineggdrop]

powershell below
Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableScriptScanning $true
Set-MpPreference -DisableRealtimeMonitoring $true

that would stop the windows defender for the scan

[bytecode77]

@milllzea006-a11y Detection is inevitable in a public repo, but for a serious user it should be effortless to make the appropriate adjustments. I made sure that everything is fileless and adjustments need to be made at very specific points - and I provide a clean code structure to make it very easy.

Yes, the powershell script (the first stage), which also implements AMSI bypass is detected.

@wineggdrop That's also one way to do it. Might need to disable AMSI, too, before you can disable Windows Defender from a PS script. Haven't tried it, but I would assume that WD flags this script, too.

Needs some tweeking and you should be fine 👌

[wineggdrop]

If you just want to bypass WD detection,there is a way
write r77 x86 and x64 bit dll into registry as reg_binary data, code an executable,install as service,handle the process polling,pipe communation,load both r77 dll binary data from registry and do the injection as pipe request or process polling
as long as the execuable is in WD execlude folder list,it works perfectly and this method works on most
antivirus with execlude scan list setting but kaspersky and bitdefender as I tested. Those two will block or kill the reflective injection since not all injected process are in the execlude scan list. Others may just block the injection to system critical process such as lsass.exe and winlogon.exe.
Cons: leave one executable file on the disk
Pros: doesn't need to shutdown Antivirus and work on most antivirus with scan execlude list setting

[kisscutclips-boop]

If you just want to bypass WD detection,there is a way write r77 x86 and x64 bit dll into registry as reg_binary data, code an executable,install as service,handle the process polling,pipe communation,load both r77 dll binary data from registry and do the injection as pipe request or process polling as long as the execuable is in WD execlude folder list,it works perfectly and this method works on most antivirus with execlude scan list setting but kaspersky and bitdefender as I tested. Those two will block or kill the reflective injection since not all injected process are in the execlude scan list. Others may just block the injection to system critical process such as lsass.exe and winlogon.exe. Cons: leave one executable file on the disk Pros: doesn't need to shutdown Antivirus and work on most antivirus with scan execlude list setting

How are u adding exclusions programatically on kaspersky, avast, bitdefender etc

[wineggdrop]

If you just want to bypass WD detection,there is a way write r77 x86 and x64 bit dll into registry as reg_binary data, code an executable,install as service,handle the process polling,pipe communation,load both r77 dll binary data from registry and do the injection as pipe request or process polling as long as the execuable is in WD execlude folder list,it works perfectly and this method works on most antivirus with execlude scan list setting but kaspersky and bitdefender as I tested. Those two will block or kill the reflective injection since not all injected process are in the execlude scan list. Others may just block the injection to system critical process such as lsass.exe and winlogon.exe. Cons: leave one executable file on the disk Pros: doesn't need to shutdown Antivirus and work on most antivirus with scan execlude list setting

How are u adding exclusions programatically on kaspersky, avast, bitdefender etc

you can't unless you know how those antiviris work on adding execlusion or manually add it by yourself on grath interface