win32api with python3 part II: AMSI

in my last/first article i tried to explain in boring detail how to use the win32api with python3 this is the second part, hold tight because things gonna get offensive ;)

in this article i would like to talk about how to entirely patch AMSI in a powershell process

before we start, big kudos to pwn1sher for the C++ script AMSIScanBufBypass which i used massively as reference

thats been said lets get right into juicy stuff

First …

amsi article big cybersecurity information security offensive patch powershell python python3 red team tools start things win32api windows