Bypass AMSI, load, and run XOR'd SharpHound payload
Tactic: Execution
BloodHound uses .NET API calls in the SharpHound ingestor component to pull Active Directory data. This uses an existing
XOR'd SharpHound payload on disk to load and run BloodHound in memory. This bypasses the Anti-malware scanning interface (AMSI)
in the current powershell process to allow loading of SharpHound.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsIngress, load, and run the SharpHound collector.
SharpHound
2021-09-07
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github