RED TEAM Operator: Windows Evasion Course

[rizzlaa]

niceee

 

[aaa@123]

Thanks

 

[neoh]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

ty

 

[opaque786]

thank you!

 

[thanhtt]

thank

 

[Casper1604]

Thanks!

 

[messssi]

king2

 

[jkiooliju]

Obrigado

 

[$p3ctr3]

Thanks man!

thx

 

[akatsuki123]

thank you

 

[hackden]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

really man!!

 

[justacoding]

Hey

 

[asdfasdfasdfa]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

Wowww!!

 

[superworthy]

thanks man

 

[pielo]

thank

 

[popk]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

thanks

 

[evily]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

 

[elNano]

thank you

 

[elNano]

thank you

 

[TayJus]

Thanks