13K subscribers
550 photos
27 videos
24 files
890 links
This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.me/APT_Notes/6

Chat Link:
t.me/APT_Notes_PublicChat
Download Telegram
🔥 Antivirus Bypass using Code Signing 🔥

Code signing is a method software publishers use to authenticate the programs they distribute to end-users. Basically, a code-signed program tells the end-user and an end-user’s computer that the program being installed/executed is from a legitimate software publisher.

Digitally signed malware can bypass system protection mechanisms that install or launch only programs with valid signatures

You can use the SignTool to sign file with a valid certificate Go Daddy.
For example:

signtool.exe sign /f t.me_secdevoops.pfx /p "*Aspider#" /t http://timestamp.digicert.com .\yourfile
.exe

This allows you to digitally sign PE binaries such as .exe, .cab, .dll, .ocx, .msi, .xpi and .xap files.

Don't forget to share and subscribe

#av #bypass #ev #signing #code
Bypass AV via Change Filenames/Extension

You need to change the files extension:
.eyb files as .exe
.faq files as .dll

Use the following commands:
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.eyb /f /ve /t REG_SZ /d exefile
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.eyb /f /v "Content Type" /t REG_SZ /d "application/x-msdownload"

This can also work on other security solutions and for many other blacklisted techniques.

#av #evasion #extension #file
Process Ghosting — EDR Evasion

The technique Process Herpaderping attempts to perform evasion by performing modification of the file (image tampering) which creates the process on a windows system. Deleting also the file during the creation of the process can have the same results. Even though some endpoint products have mature over the years and are able to detect complex threats organizations should constantly test the capabilities of their solution and should find alternate methods of detection even for the same technique.

https://pentestlaboratories.com/2021/12/08/process-ghosting/

#av #evasion #process #redteam #blueteam
Bypass AV & Advanced XDR solutions

Mortar Loader is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following:

— Kaspersky
— ESET
— Malewarebytes
— Mcafee
— Cortex XDR
— Windows defender
— Cylance

Research:
https://0xsp.com/security%20research%20&%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions

Source:
https://github.com/0xsp-SRD/mortar

#av #xdr #evasion #redteam
PSSW100AVB

This is the PSSW100AVB (Powershell Scripts With 100% AV Bypass) Framework.
A list of useful Powershell scripts with 100% AV bypass ratio. (At the time of publication).
Latest Reverse shell tested on Windows 11 (ReverseShell_2022_03.ps1)

https://github.com/tihanyin/PSSW100AVB

#av #evasion #amsi #powershell #ps1