Ghosting AMSI and Taking Win10 and 11 to the DarkSide

In this episode of The Weekly Purple Team, we explore a new method to bypass the Anti-Malware Scan Interface (AMSI) using a powerful tool: Ghosting-AMSI. This approach allows us to inject malicious PowerShell payloads without being blocked by Defender or other AV tools.

🚩 Once AMSI is bypassed, we move straight into PowerShell Empire C2 agent control, which successfully executes on both Windows 10 and Windows 11 systems.

🔍 From a purple team perspective, we flip to the blue side: analyzing how to detect this attack in your SIEM using memory instrumentation clues like VirtualProtect and VirtualAlloc, commonly seen in memory injection scenarios.

🎯 What You’ll Learn:

How AMSI ghosting evades standard Windows defenses

Gaining full control with PowerShell Empire post-bypass

Behavioral indicators to watch for in EDR/SIEM

Detection strategies using native logging and memory-level heuristics

🧪 Tools Used:

Ghosting-AMSI
https://github.com/andreisss/Ghosting...

PowerShell Empire
https://github.com/BC-SECURITY/Empire

Windows Defender & event logs

SIEM detection patterns for memory modification APIs

📽️ Chapters:
00:00:00 – Intro
00:01:56 – AMSI Bypass Win10
00:02:40 – Empire Agent Win10
00:03:52 – AMSI Bypass Win11
00:06:00 – Detecting AMSI Ghosting
00:06:58 – Detecting VirtualProtect
00:07:45 – Detecting VirtualAlloc

⚠️ Disclaimer: This demonstration is strictly for educational and authorized research purposes. Never attempt these techniques in environments where you lack explicit permission.

#AMSIBypass #GhostingAMSI #PurpleTeam #PowerShellEmpire #CyberSecurity #RedTeam #BlueTeam #DetectionEngineering #WindowsSecurity #MalwareAnalysis #MemoryInjection