AMSI-Bypass-HWBP : A Tool For Evading AMSI Detection

AMSI (Antimalware Scan Interface) is a Windows feature designed to help protect systems from malware by scanning scripts and files for malicious content.

However, attackers often seek to bypass AMSI to execute malicious scripts undetected. One such tool for bypassing AMSI is AMSI-Bypass-HWBP, which utilizes a small debugger to manipulate the behavior of AMSI.

Functionality Of AMSI-Bypass-HWBP

AMSI-Bypass-HWBP operates by creating a new instance of powershell.exe or attaching to an existing one.

It then sets a hardware breakpoint at the address of the AmsiScanBuffer() function within amsi.dll. This function is crucial as it scans buffers for malware.

Once the breakpoint is triggered, the tool modifies the third parameter of AmsiScanBuffer(), which is the length of the buffer to be scanned, stored in the R8 register.

By setting this length to 1, the tool ensures that AmsiScanBuffer() only scans a single byte of the buffer.

This manipulation results in AMSI_RESULT_CLEAN, indicating that the scanned content is clean, effectively bypassing AMSI’s detection.

• Setting Hardware Breakpoints: The tool uses Windows API functions to set a hardware breakpoint on AmsiScanBuffer(). This allows it to intercept and modify the function’s behavior at runtime.
• Modifying the Length Parameter: By changing the length parameter to 1, the tool limits the scan to a single byte, which is unlikely to trigger any malware detection.
• Result: The manipulation leads to a clean scan result, allowing malicious scripts to execute without being flagged by AMSI.

The development of AMSI-Bypass-HWBP was influenced by Justin Seitz’s book, “Gray Hat Python”, which provides insights into using Windows API functions for debugging processes.

This knowledge is crucial for understanding how to interact with and manipulate system-level functions like those in AMSI.

In summary, AMSI-Bypass-HWBP is a sophisticated tool that exploits the behavior of AMSI by manipulating its scanning function, allowing attackers to execute scripts without detection.

Its development highlights the ongoing cat-and-mouse game between security measures and evasion techniques in the cybersecurity landscape.