"Check Real Time protection is enabled" error

[eXPeri3nc3]

Hi, I tried the release binary, and downloading the sourcecode to compile and run it

I tested with a Powershell script, but I can only see the "[+] Check Real Time protection is enabled" error, while my Windows Defender protection is all turned on.
I tried --inputfile and -u, but still same error, for the v2 release binary, and v3 selfcompile

Is there a way for me to diagnose further what could be the issue? Thanks!

[RythmStick]

Hi eXPeri3nc3 - the protectionenabled method check runs initially and passes the text "amsiscanbuffer" (a known trigger) to AMSIScanBuffer.

As a test, you could run powershell and see whether that string produces a blocked by your AV message. See attached screenshot.

[eXPeri3nc3]

Hi RhythmStick!

I tried, and yes it's being blocked - similar to your screenshot. Would that mean that I need to bypass that first ('AMSIScanBuffer') before I can see other triggers that the ps1 may still have?

Or did I misunderstand the error that I need to disable realtime protection before using AMSITrigger?

Also just tried disabling WinDef and I still get the error (I ran it on vanilla Invoke-Mimikatz in a whitelisted directory)

[RythmStick]

No you didnt misunderstand. The fact that you generated the AV alert when you passed it "AMSIScanbuffer" proves that real time protection is on - which it needs to be. What it doesnt help with is why AMSITrigger thinks that real time protection is switched off, because its effectively doing exactly that. Do you have any exceptions in place maybe for that d:\ drive ?

[RythmStick]

so for instance, if you run powershell as an admin,

[eXPeri3nc3]

Yes I did add Exclusion path, else the Invoke-Mimikatz would automatically be removed by Defender when I run AMSITrigger 

[eXPeri3nc3]

This is how it looks like:

[RythmStick]

Sure - my question was more about is there an exclusion for the folder where the AMSITrigger assembly is, rather than the target.

[RythmStick]

could you try copying invoke-mimikatz.ps1 to another (non-excluded) folder with a different name, eg. invoke-mimi.ps1 and then try AMSITrigger on that file.

[eXPeri3nc3]

could you try copying invoke-mimikatz.ps1 to another (non-excluded) folder with a different name, eg. invoke-mimi.ps1 and then try AMSITrigger on that file.

Yes sure, as follows:

No exclusions in my home folder, renamed, showed something slightly diff this round

Similar error with PS as the terminal:

[RythmStick]

[RythmStick]

which version of AMSITrigger you running - just so we have like-for-like

[eXPeri3nc3]

which version of AMSITrigger you running - just so we have like-for-like

I was running the build v2 x86 for prior examples.

I just figured out what triggers the Check realtime protection message.
If I chose in Defender to allow the files on the PC that error message will occur. Else the file will be removed and it will show back the same Unhandled Exception error message

^ This was run with your latest codebase

[eXPeri3nc3]

yeah - I understand that 2nd case as defender is quite-rightly removing the malicious file before AMSITrigger tries to open it. In the 2nd case (no exclusion in place) can you run AMSITrigger without any parameters

Yes it runs and shows the above

[RythmStick]

yeah - I understand that 2nd case as defender is quite-rightly removing the malicious file before AMSITrigger tries to open it.

[RythmStick]

Could you look at the properties of this file:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
in explorer and tell me what product version it is (details tab)

[RythmStick]

It might be worth matching up your version with this line. Just change the powershell.exe_10.0.18362.1 to match yours, recompile, then try again.

[eXPeri3nc3]

Could you look at the properties of this file:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
in explorer and tell me what product version it is (details tab)

Please see below:

[RythmStick]

Let me know how that goes.

[RythmStick]

so change to powershell.exe_10.0.19041.546

[eXPeri3nc3]

so change to powershell.exe_10.0.19041.546

Got it, will revert when I managed to compile. Didn't realise the VS I was using was Professional and the trial period expired - getting the Community version installer now

[eXPeri3nc3]

so change to powershell.exe_10.0.19041.546

No luck. I removed the allowed threats just to be sure and the same error still occurs

[S3cur3Th1sSh1t]

Just put the .ps1 file and the AmsiTrigger.exe in an AV-excluded folder. ;-)

[RythmStick]

Pretty sure that's been tried S3curTh1sSh1t but happy to try anything at this point..

[eXPeri3nc3]

Just put the .ps1 file and the AmsiTrigger.exe in an AV-excluded folder. ;-)

Holyshit that actually worked!

[eXPeri3nc3]

So I guess the fix is to whitelist the folder that AMSITrigger is running from

Thank you RythmStick (for spending time to diagnose) & S3cur3Th1sSh1t for the suggestion

[S3cur3Th1sSh1t]

Instead you could also "obfuscate" Amsitrigger by changing the namespace and class names before compilation but the exclusion is the easiest way so far. 🚀

[RythmStick]

Just glad it's working 😊 thanks S3cur3Th1sSh1t

[unch4rt3d]

Even if this issue is considered closed, I'd like to add something for Win 10/11 22H2 builds and the according Defender versions:
As Windows Defender now ignores directory exclusions for really bad binaries, the tool can hardly be used. If you exclude the directory for AMSITrigger, the binary's process will be blocked by Defender nonetheless. If you exclude the process directly, the tool will output that real time protection is not enabled. No easy way around Windows Defender in 2023. I guess I'd need to try an older version of Windows/Defender or obfuscating the whole thing itself...
Nonetheless I'd like to thank you @RythmStick for the effort and the nice idea!

[Ab4y98]

Even if this issue is considered closed, I'd like to add something for Win 10/11 22H2 builds and the according Defender versions: As Windows Defender now ignores directory exclusions for really bad binaries, the tool can hardly be used. If you exclude the directory for AMSITrigger, the binary's process will be blocked by Defender nonetheless. If you exclude the process directly, the tool will output that real time protection is not enabled. No easy way around Windows Defender in 2023. I guess I'd need to try an older version of Windows/Defender or obfuscating the whole thing itself... Nonetheless I'd like to thank you @RythmStick for the effort and the nice idea!

Any idea which version of Windows this tool can still work with?