Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.
Contents
Intro and Setup
Course IntroductionDevelopment VM Setup
RTO-WinEva.ova
WEv.zip
Essentials
Modern Detection TechEvasion Development Rules
Binary Entropy
Module Details
Binary Signature
Non-privileged user vector
Introduction To Process UnhookingHooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping
High-privileged user vector
Blinding EventlogBlocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon
Summary
Evasion Decision TreeClosing Words
