https://youtu.be/FiT7-zxQGbo

#c2 #cpp

LdrLoadDll-Unhooking

https://github.com/trickster0/LdrLoadDll-Unhooking

#edr #evasion #dll #cpp

Ares

This project is a PoC loader written in C/C++ based on the Transacted Hollowing technique. It features:

— PPID spoofing
— Dynamic function resolution with API hashing
— NTDLL unhooking
— AES256 CBC Encryption
— CIG to block non-Microsoft-signed binaries

https://github.com/Cerbersec/Ares

#edr #evasion #cpp

Malware Analysis: Syscalls

Great guide and overview about Syscalls and how to start diagnosing them.

https://jmpesp.me/malware-analysis-syscalls-example/

#maldev #cpp #syscall

Evading WinDefender ATP Credential Theft

https://b4rtik.github.io/posts/evading-windefender-atp-credential-theft-kernel-version/

#windows #native #api #kernel #cpp

RefleXXion

RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.

https://github.com/hlldz/RefleXXion

#edr #evasion #cpp #redteam