powershellveryless
== Constrained Language Mode + AMSI bypass all in one ==
Quick & dirty (and very simple) CL + AMSI bypass using C#
2019-03-27: The 2019-03-19 version version is again caught by latest definitions, but it's easy to bypass (tested it).
Given that the game has become boring, I won't publish any other updates, it's up to you ;-)
2019-03-19: addded a new quick&dirty fix in order to bypass latest Defender definitions
2019-03-13: addded quick&dirty fix in order to bypass latest Defender definitions and integrate new AMSI bypass
https://github.com/rasta-mouse/AmsiScanBufferBypass/blob/master/ASBBypass/Program.cs
Compile it (https://decoder.cloud/2017/11/02/we-dont-need-powershell-exe/):
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /reference: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\system.management.automation.dll
/out:c:\setup\powershellveryless.exe c:\scripts\powershellveryless.cs
Launch it: powerhsellveryless.exe (your_ps1_script)
powershellveryless_2.cs "installutil" version:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil /logfile= /LogToConsole=false /ScriptName=(your_ps1_script) /U (exefile)