PSSW100AVB

This is the PSSW100AVB (Powershell Scripts With 100% AV Bypass) Framework.
A list of useful Powershell scripts with 100% AV bypass ratio. (At the time of publication).
Latest Reverse shell tested on Windows 11 (ReverseShell_2022_03.ps1)

https://github.com/tihanyin/PSSW100AVB

#av #evasion #amsi #powershell #ps1

Unmanaged Code Execution with .NET Dynamic PInvoke

https://bohops.com/2022/04/02/unmanaged-code-execution-with-net-dynamic-pinvoke/

#edr #evasion #pinvoke #csharp #blog

AppRecoveryCallback Inject

Overwrite a process's recovery callback and invoke a crash to execute

https://github.com/Wra7h/ARCInject

#av #edr #evasion #inject #csharp

In-Process Patchless AMSI Bypass

https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/

#amsi #bypass #av #evasion

A blueprint for evading industry leading endpoint protection in 2022

In this post, I’d like to lay out a collection of techniques that together can be used to bypassed industry leading enterprise endpoint protection solutions. This is purely for educational purposes for (ethical) red teamers and alike, so I’ve decided not to publicly release the source code. The aim for this post is to be accessible to a wide audience in the security industry, but not to drill down to the nitty gritty details of every technique. Instead, I will refer to writeups of others that deep dive better than I can:

https://vanmieghem.io/blueprint-for-evading-edr-in-2022/

#av #edr #evasion #research

💉 From Process Injection to Function Hijacking

This post about FunctionHijacking, a "new" process injection technique built upon Module/Function Stomping, along with experiments to break behavioral based detection of other common process injection techniques.

https://klezvirus.github.io/RedTeaming/AV_Evasion/FromInjectionToHijacking/

#av #evasion #maldev #redteam #research

🔐 Dumping LSASS with AV

Sometimes Antivirus is attackers' best friend. Here is how you can use Avast AV to dump lsass memory

Commands:
.\AvDump.exe --pid 704 --exception_ptr 0 --thread_id 0 --dump_level 1 --dump_file lsass.dmp

To bypass Microsoft Defender, remember to rename the AvDump.exe file. Also, don't use the name lsass.dmp (see screenshot).

There's also Metasploit post exploitation module for this under post/windows/gather/avast_memory_dump

AvDump.exe is located at C:\Program Files\Avast Software\Avast.

You can also download AvDump.exe from this link.

VirusTotal Details:
https://www.virustotal.com/gui/file/52a57aca1d96aee6456d484a2e8459681f6a7a159dc31f62b38942884464f57b/details

#ad #evasion #lsass #dump #avast #redteam

🛠 API Unhooking with Perun's Fart

An article about a new method of avoiding AV/EDR by creating a process in a suspended state and getting a copy of the ntdll from the new process before it is hijacked by AV/EDR.

Research:
https://dosxuz.gitlab.io/post/perunsfart/

PoC:
https://github.com/dosxuz/PerunsFart

#av #edr #evasion #api #unhooking #resarch

😴 DeepSleep

A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC

https://github.com/thefLink/DeepSleep

#memory #evasion #maldev

😈 How to Detect Linux Anti-Forensics Log Tampering

When forensically examining Linux systems for malicious intrusion, responders often rely on the following three artefacts to determine logins and logouts:

— /var/run/utmp – currently logged in users
— /var/run/wtmp – current, past logins and system reboot
— /var/log/btmp – bad login attempts

Of course, these artefacts are not all you can forensically investigate for malicious access, however, these will be the focus of this anti-forensics blog post.

https://www.inversecos.com/2022/06/detecting-linux-anti-forensics-log.html

#linux #log #evasion #antiforensics