the powershell script is detectable.

[zisis912]

as you can see in the image, i ran the AMSI bypass powershell command, but it was detected. Literally the only antivirus that i have is windows defender. (The normal non-AMSI command didn't even work, it just closes powershell)
I am using windows/meterpreter/reverse_https i think.

I followed this guide to use it.
https://null-byte.wonderhowto.com/how-to/hacking-windows-10-create-undetectable-payload-part-1-bypassing-antivirus-software-0185055/

[ghost]

You should watch this: https://www.youtube.com/watch?v=6G9DD6SkVqk
then you will know why this happens.
It is normal. If it is detected, don't freak out, it's normal, like I said.

[zisis912]

Isn't this entire project made to create undetectable payloads? Why would you need to rewrite the tool to make it create undetectable scripts

[zisis912]

also, i should mention that powershell also blocks scripts for thefatrat

[ghost]

Watch the video I sent and you will understand better how the tool works (hopefully).
Also, you don't have to re-write the entire tool for it to work.

Seriously, watch the YT video when you are bored or whatever. It will make better sense to you.

[zisis912]

I watched the video, and im wondering which one of these ways should I use to make the script bypass amsi? Modify the base64 code, use that project by rasta, or use that guide to modify metasploit's payload.dll

Also, shouldn't unicorn bypass amsi by default? Does a new amsi bypass get added every week?

[ghost]

I suggest you join the discord server and ask in the #ask-help channel. https://discord.gg/trustedsec

[zisis912]

I asked, but it takes over a day for anyone to answer