Decrypting a powershell script and executing it using scriptblock smuggling, bypassing AMSI and some telemetry.
Powershell-Smuggler is a compact, tiny powershell script that works by base64 decoding and XOR decrypting an encrypted powershell command or script. After that, it will execute the powershell code using scriptblock smuggling, bypassing AMSI and some powershell logging. Its small size also makes it easy to evade static signature detection.
By default, Powershell-Smuggler will just execute Invoke-Mimikatz, a common command used to test the Windows Defender AMSI provider, you can change it by XOR encrypting and then base64 encoding your powershell payload, and replacing 0xEB,0xC1,0x89,0xB4 and oq//24CkpPmCrODfirXz in Powershell-Smuggler with a key for XOR decryption and your encoded payload.
Bypassing AMSI for the Invoke-Mimikatz command:
Hiding the real command that will be executed:
More information about the scriptblock smuggling technique can be found here: