🔔 TamperingSyscalls

This is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls.

Research:
🔗 https://fool.ish.wtf/2022/08/feeding-edrs-false-telemetry.html

Source:
🔗 https://github.com/rad9800/TamperingSyscalls

#edr #evasion #maldev #syscall #tampering

💉ClipboardInject

Abusing the clipboard to inject code into remote processes

This PoC uses the clipboard to copy a payload into a remote process, eliminating the need for VirtualAllocEx/WriteProcessMemory

https://www.x86matthew.com/view_post?id=clipboard_inject

#maldev #injection #clipboard #redteam

📌 Save the Environment

Many applications appear to rely on Environment Variables such as %SYSTEMROOT% to load DLLs from protected locations.
By changing these variables on process level, it is possible to let a legitimate program load arbitrary DLLs.

Research:
https://www.wietzebeukema.nl/blog/save-the-environment-variables

Source Code:
https://github.com/wietze/windows-dll-env-hijacking

#maldev #dll #hijacking #environment

😈 EDRSandBlast: Update

— User-mode (API hooking) evasion;
— Kernel-mode (callbacks and ETW ThreatIntel events) evasion;
— Successively tested on market-leading EDR products.

https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release

#maldev #edr #lsass #evasion #redteam

⚙️ Hackers No Hashing: Randomizing API Hashes to Evade Cobalt Strike Shellcode Detection

If you utilise API hashing in your malware or offensive security tooling. Try rotating your API hashes. This can have a significant impact on detection rates and improve your chances of remaining undetected by AV/EDR.

Blog:
https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection

Source:
https://github.com/matthewB-huntress/APIHashReplace

#maldev #evasion #hinvoke #cobaltstrike #redteam

🎲 Fileless Remote PE

Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique

https://github.com/D1rkMtr/FilelessRemotePE

#maldev #evasion #fileless #pe

🛠 DynamicSyscalls

This is a library written in .net resolves the syscalls dynamically (Has nothing to do with hooking/unhooking).

https://github.com/Shrfnt77/DynamicSyscalls

#maldev #csharp #syscall #library

🥷 PNG Steganography Hides Backdoor

Malware authors rely on LSB encoding to hide malicious payload in the PNG pixel data, more specifically in LSB of each color channel (Red, Green, Blue, and Alpha).

https://decoded.avast.io/martinchlumecky/png-steganography/

#maldev #steganography #png

💤 laZzzy

This is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.

Features:
— Direct syscalls and native functions;
— Import Address Table (IAT) evasion;
— Encrypted payload (XOR and AES);
— PPID spoofing;
— Blocking of non-Microsoft-signed DLLs;
— etc.

https://github.com/capt-meelo/laZzzy

#maldev #loader #cpp #redteam

👾 HeapCrypt

Encypting the Heap while sleeping by hooking and modifying Sleep with our own sleep that encrypts the heap.

https://github.com/TheD1rkMtr/HeapCrypt

#maldev #heap #encypt #sleep #cpp