THAMARA - Threat Hunting with AMSI and YARA

Command Line for Antimalware Scan Interface (AMSI)

Miscellaneous Code and Docs

Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

Patch AMSI and ETW in remote process via direct syscall