whydee86/SnD_AMSI

Start new PowerShell without etw and amsi in pure nim

SnD_AMSI

Search and Destroy AMSI Remotely

Start new PowerShell without etw and amsi in pure nim

Compile:

nimble install winim  
nim c -x -f StartCleanPS.nim

POC

Credits:

• https://github.com/byt3bl33d3r/OffensiveNim
• Thank you, Elddy for the idea of patching amsi in that way. https://github.com/elddy