AMSI bypass hooking NtCreateSection
POC for Rubeus execution.
Execute Openssl-Dev.exe "commands" to execute Rubeus (file deletefile.txt has to be in the same path, or change the file in the code)
waawaa/AMSI_Rubeus_bypass
Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|