# In-Process Patchless AMSI Bypass

DevFeed: [In-Process Patchless AMSI Bypass](<https://devfeed.tech/articles/in-process-patchless-amsi-bypass-32633.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/>)

Author: CCob

Published: 2022-04-17T16:30:25Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Windows](<https://devfeed.tech/topics/windows.md>), [Exception](<https://devfeed.tech/topics/exception.md>), [exceptions](<https://devfeed.tech/topics/exceptions.md>), [debug](<https://devfeed.tech/topics/debug.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [breakpoint](<https://devfeed.tech/tags/breakpoint.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [c2](<https://devfeed.tech/tags/c2.md>), [context](<https://devfeed.tech/tags/context.md>), [debugger](<https://devfeed.tech/tags/debugger.md>), [edr](<https://devfeed.tech/tags/edr.md>), [exception](<https://devfeed.tech/tags/exception.md>), [exception-handling](<https://devfeed.tech/tags/exception-handling.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extension](<https://devfeed.tech/tags/extension.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

This article explains an in-process, patchless AMSI bypass approach using vectored exception handling. It contrasts this technique with SharpBlock's debugger-based child-process method and describes manipulating thread context at the point an exception occurs.

## Source excerpt

Some of you may remember my patchless AMSI bypass article and how it was used inside SharpBlock to bypass AMSI on the child process that SharpBlock spawns. This is all well a good when up against client environments that are not too sensitive to the fork and run post exploitation model of operating. What about [...] The post In-Process Patchless AMSI Bypass appeared first on Ethical Chaos.