Ghosting AMSI: Cutting RPC to disarm AV
medium.com
In this post, we explore how to bypass AMSI’s scanning logic by hijacking the RPC layer it depends on — specifically the NdrClientCall3…