CCRTS Practice Questions - CREST Certified Red Team Specialist (CCRTS) Exam

Access More Questions

An operator wants to bypass Windows Defender AMSI (Antimalware Scan Interface) before loading a PowerShell-based implant. Which technique directly patches the AmsiScanBuffer function in memory?

Encoding the payload with base64 and piping it through iex Disabling PowerShell Constrained Language Mode via registry Patching the AmsiScanBuffer return value to AMSI_RESULT_CLEAN in the process memory Setting the AMSI_DISABLE environment variable before launching PowerShell

Correct Answer:

Patching the AmsiScanBuffer return value to AMSI_RESULT_CLEAN in the process memory

Access more questions from this quiz

Continue to CCRTS Practice Questions - CREST Certified Red Team Specialist (CCRTS) Exam for more practice questions and the full quiz experience.

Access More Questions