Antivirus bypass using PowerShell
Unlike the techniques we have introduced so far, this technique is not based on a malicious executable file but is used mostly as fileless malware. With this technique, there is no file running on the hard drive; instead, it is running directly from memory.
While researching and writing this book, we used PowerShell fileless malware, the malicious functionality of which involves connecting to a remote server through a specific port. We divided the test into two stages. In the first part, we ran the payload from a PS1 file, which is saved to the hard drive, and in the second part, we ran the payload directly from PowerShell.exe.
The following screenshot illustrates that the Sophos antivirus software managed to successfully detect the PS1 file with the malicious payload saved to the hard drive with the name PS.ps1:
Figure 6.14 – Sophos Home detected the malicious PS1 file
Then, instead of running the malicious payload...