methodology
Powershell scripts
Use InviShell to disable PowerShell logging, has a built-in AMSI bypass.
Alternitavely use an AMSI bypass
If static detection is a problem, try obfuscating the tool.
Binaries
https://raw.githubusercontent.com/Raptoratack/ADTools/refs/heads/main/ArgSplit.bat https://github.com/Raptoratack/ADTools/blob/main/Loader.exe
Use ArgSplit to obfuscate the command argument, e.g: kerberoast, asktgt, etc... Copy and paste all the set :
[!] Argument Limit: 180 characters
[+] Enter a string: asktgt
set "z=t"
set "y=g"
set "x=t"
set "w=k"
set "v=s"
set "u=a"
set "Pwn=%u%%v%%w%%x%%y%%z%"Check that the %Pwn% variable is what the want.
Use Loader.exe to load our binaries (Rubeus example):
Use Loader.exe with the behaviour detection bypass
Last updated