RED TEAM Operator: Windows Evasion Course

[popbyq6si]

nice

 

[pekdwh62503]

Niubi

 

[sysxnoob]

amazing !

 

[babyhulkk]

SICKKKKK

 

[ModeMenu]

thanks sir

 

[memo]

thanks

 

[dr0x19dz]

thank u

 

[0utrage7]

again. thank you for sharing this

 

[SeKTor7]

Thanks

 

[sissy123]

<3

 

[sebbi]

thanks

 

[Anathol]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

Thanks

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

Thanks

 

[jack8319]

Thx

 

[jujun]

Thanks really

 

[hackerisherehahah]

Vh

 

[omegalmao13]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

thank you!

 

[xyz.lel]

cheers

 

[C++void]

hfgy

 

[C++VOl]

sdfsdf

 

[CummyScummy]

Thank you so much