Decrypting a powershell script and executing it using scriptblock smuggling, bypassing AMSI and some telemetry.
Powershell-Smuggler is a compact powershell script that works by base64 decoding and XOR decrypting an encrypted powershell command or script. After that it will execute the powershell command using scriptblock smuggling, bypassing AMSI and some powershell logging.
By default Powershell-Smuggler will just execute "Invoke-Mimikatz", a common command used to test the Windows Defender AMSI provider, you can change it by XOR encrypting and then base64 encoding your powershell payload, and replacing "$a" and "$b" in Powershell-Smuggler with a key for XOR decryption and your encoded payload.
Bypassing AMSI for the Invoke-Mimikatz command:
Hiding the real command that will be executed:
More information about the scriptblock smuggling technique can be found here: