Evading EDR/AV software with Invoke-Mimikatz.ps1

I have done some research lately on running Mimikatz on modern systems having antivirus and EDR software installed and have found some cool resources you can see in the links section below.

Then, during a pentest I was involved in I came across an issue that may occur when invoking Mimikatz from within PowerShell script that results in returning tons of error messages that begin with:

Exception calling "GetMethod" with "1" argument(s): "Ambiguous match found."

and ends with:

VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new
PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might
be free).

Continue reading