Do I need to bypass the AV before executing the MSbuild command

[Ilyesdhiaeddine]

[Sh3lldon]

Seems a powershell reverse shell detected by AV. Try to obfuscate or use another one. The AMSI bypass and FullLanguage mode work fine.

[beauknowstech]

@Ilyesdhiaeddine you should be able to IEX a ps1 that contains a reverse shell. That way the powershell section that is getting flagged by AV isn't there. In theory AMSI will be bypassed so the ps1 file can contain a generic reverse shell

[beauknowstech]

@Ilyesdhiaeddine I made a small change in my fork of this project that shouldn't get caught by AV. Link if you want to take a look: https://github.com/beauknowstech/FullBypass

[Sh3lldon]

Thanks you! I will take a look. Also maybe I will made a good update in short time.