Hubble

Upon further investigation. There seems to be some issue when using -GetMinimallyObfuscated with -ScriptPath even when running PSAMSI client/server from the same box

@cobbr No problem I am trying to obfuscate the initial stage 0 from Powershell Empire as I already know about what that should look like: `If($PSVERSiONTAbLe.PSVErSION.MAjor -GE 3){ $e01=[ReF].AsSEMBLy.GEtTYpE('System.Management.Automation.Utils')."GETFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static'); If($e01){...

@cobbr just an update. It does work if I pass the script in as a one liner but Get-MinimallyObfusctaed does not seem to work with the -ScriptPath switch. It simply...

@cobbr here is how I am normally starting it when not using the Server/Client setup between kali and windows box: ` $Ref=[REF].Assembly.GetType('System.Management.Automation.Am'+'siU'+'tils'); $Ref.GetField('amsi'+"Init"+"Failed",'NonPublic,Static').SetValue($NULL,$true);` `Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass;` `Import-Module .\PSAmsi.psd1;`...

I'm in too!

O also forget ti mention that while the VBA launch via RDS.DataSpace does avoid AMSI as soon as I try to inject into a new process that agent/stager is flagged

> Most likely `handle_agent_staging` in `lib/common/agents.py` > […](#) > On Fri, Apr 12, 2019 at 12:50 PM lonewolf210 ***@***.***> wrote: Empire Version 2.5 OS Information (Linux flavor, Python version) Kali...

OKay. Thank you. If you don't mind me asking one more question. If I was looking at modifying the powershell download cradles would I need to modify every module or...

Just to add a bit of context trying to do some research on JA3 signatures and seeing what may or may not change them

There are a number of alternatives out there, the most popular at the moment is probably covenant. Faction and Apfell are also pretty popular. BC Security has forked the Empire...