Dynamic Microsoft Office 365 AMSI In Memory Bypass Using VBA

By Richard Davy (@rd_pentest) & Gary Nield (@Monobehaviour) As most Pentesters know, Windows Defender is installed by default on Windows 10 and all new versions of Windows Server. During an engagement this can sometimes be frustrating, when wanting to obtain access to a remote machine, especially during a Phishing engagement. There are multiple AMSI bypassesContinue reading Dynamic Microsoft Office 365 AMSI In Memory Bypass Using VBA