RED TEAM Operator: Windows Evasion Course

[Reigin]

ty

 

[Hang1234567]

Thank You So Much！！！

 

[ITACHI__UCHIHA]

thnx

 

[elboi]

Nice

 

[hsspamspam]

Thanks!

 

[CyberDasGo]

thanks

 

[samwatkins435]

thanks

 

[401xx]

.

 

[0xl34k]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

Thannnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnks

 

[BibasXettri]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

Thanks

 

[haavard961]

Top G

 

[alav]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

d

 

[ITACHI__UCHIHA]

hi

 

[ITACHI__UCHIHA]

tnx

 

[yoooobroooo]

Thanks

 

[eoifh]

dawd

 

[hhdxz]

thanks

 

[FireGhost]

了解如何利用众所周知的、鲜为人知的和内部开发的技术来避免现代端点保护技术。

内容​

简介和设置​

课程介绍
开发虚拟机设置
RTO-WinEva.ova
WEv.zip

必需品​

现代检测技术
规避开发规则
二元熵
模块详情
二进制签名

非特权用户向量​

进程脱钩简介
挂钩与代码注入
脱钩过程 - “经典”
胡克斯 vs 地狱之门
胡克斯 vs 光环之门
进程脱钩 - Perun 的屁
静默进程事件追踪
模块踩踏
无新线程有效负载执行
“经典”PPID 欺骗
改变父母 - 调度程序
改变父母 - Emotet 方法
命令行参数欺骗
作业 #1 - 钩子
作业 #2 - 模块踩踏

高权限用户向量​

致盲事件日志
阻止 EPP 通信 - 列出连接
阻止 EPP 通信 - 防火墙
阻止 EPP 通信 - 路由表 (P1)
阻止 EPP 通信 - 路由表 (P2)
与 Sysmon 共舞 - 检测
与 Sysmon 共舞 - 杀死他们！
与 Sysmon 共舞 - 无声插科打诨
作业 #3 - Sysmon
作业 #4 - Sysmon

​

概括​

规避决策树
结束语

在线观看或下载：-​

[隐藏内容]

谢谢

 

[shinxx]

good job

 

[hacker1024]

Thanks