Cyber security

AMSI Bypass via VEH – Technique Using Vectored Exception Handling

A PowerShell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification.


How It Works:

For this technique to work, you must first inject the VEH DLL into the PowerShell process. This can be done either by injecting the DLL or via DLL hijacking .

This technique works by setting up a hardware breakpoint on the function AmsiScanBuffer on all PowerShell process threads, then installing a VEH to handle the trigger of this breakpoint.

When a thread calls AmsiScanBuffer, the VEH will make the thread to exit the function without executing anything and setting the result of the function to AMSI_RESULT_CLEAN.

This is all done inside the VEH, without modifying the code of the process or without any PE modifications.


Usage:

For demonstration purposes, this repository contains a very basic DLL injector. Use it this way:

  • 1.) Compile the DLL Injector and VEH DLL.
  • 2.) Open an instance of PowerShell.
  • 3.) Run the DLL injector by providing the FULL PATH to the DLL. Example:
./DLL_Injector.exe C:\Windows\Temp\AMSI_VEH.DLL
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

2 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

2 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

2 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 weeks ago