RED TEAM Operator: Windows Evasion Course

[fdreamer]

ありがとう

 

[Tonaka]

thanks

 

[testdemo]

Thanks

 

[w16n]

bump

 

[hackverdi]

thanks

 

[junjun]

thankss

 

[cx4hexx]

thanks

 

[mrcv]

спасиба за керс

 

[WhyNot]

Thanks

 

[omegalmao1.1]

thanks!

 

[M0NT3R0_FR1NCH]

thanks

 

[securitynoob]

thanks

 

[securitynoob]

thank you!

 

[securitynoob]

there

 

[Fister]

谢谢你，我的朋友

 

[sas]

good

 

[Nazix712]

Thanks !!

 

[bagutilisties]

thanks!!!

 

[zabimaru]

thank you

 

[psycr0w]

Learn how to avoid modern endpoint protection technology with well-known, less known, and in-house developed techniques.

Contents​

Intro and Setup​

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip

Essentials​

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature

Non-privileged user vector​

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping

High-privileged user vector​

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon

​

Summary​

Evasion Decision Tree
Closing Words

Watch Online Or Download:-​

[Hidden content]

THANKSS