00. Resources
https://securityintelligence.com/x-force/bypassing-windows-defender-application-control-loki-c2/
Check defense
https://github.com/gatariee/gocheck
Maldev modules
Module Number | Module Name | EDR Bypass Technique | Notes |
---|---|---|---|
20 | Evading Microsoft Defender Static Analysis | Encryption to bypass static analysis | XOR, RC4, AES |
65 | Syscalls - SysWhispers | Using SysWhispers to evade EDR API hooks | |
66 | Syscalls - Hell's Gate | Direct syscalls to bypass userland hooks | |
67 | Syscalls - Reimplementing Classic Injection | Performing injection without WinAPI | |
68 | Syscalls - Reimplementing Mapping Injection | Evading detection by mapping memory | |
69 | Syscalls - Reimplementing APC Injection | Direct syscall-based APC injection | |
82 | Introduction To EDRs | General understanding of EDR detection methods | |
83 | NTDLL Unhooking - Introduction | Introduction to unhooking NTDLL to evade EDR | |
84 | NTDLL Unhooking - From Disk | Replacing in-memory NTDLL with a clean version | |
85 | NTDLL Unhooking - From KnownDlls Directory | Using KnownDlls directory for unhooking | |
86 | NTDLL Unhooking - From a Suspended Process | Extracting clean NTDLL from a suspended process | |
87 | NTDLL Unhooking - From a Web Server | Loading NTDLL from an external source | |
88 | Updating Hell's Gate | Improving syscall retrieval for stealth | |
89 | Indirect Syscalls - HellsHall | Using indirect syscalls to bypass EDR | |
90 | Block DLL Policy | Blocking non-Microsoft DLLs for stealth | |
92 | Exploiting EDRs For Evasion | Finding vulnerabilities in EDR logic | |
93 | Exploiting EDRs For Evasion - Preventing EDR Actions | Preventing EDR from deleting payloads | |
94 | Exploiting EDRs For Evasion - EDR LOLBINS | Using EDR-signed binaries to evade detection | |
95 | Exploiting EDRs For Evasion - Internal Exclusion List | Exploiting internal EDR exclusions for stealth | |
96 | Patchless Threadless Injection Via Hardware BreakPoints | Evasive shellcode execution using hardware breakpoints | |
97 | Tampered Syscalls Via Hardware BreakPoints | Manipulating syscall arguments for EDR evasion | |
98 | Process Hypnosis | New injection technique using debug events | |
99 | Sleep Obfuscation Techniques | Evading memory scanning using sleep obfuscation | |
100 | Introduction to Ekko and Zilean Sleep Obfuscation | Using Ekko/Zilean techniques to obfuscate execution | |
101 | Introduction to Foliage Sleep Obfuscation | Another memory evasion technique | |
102 | Implementing Ekko With Stack Spoofing | Spoofing stack for memory stealth | |
103 | Heap Encryption With Ekko Sleep Obfuscation | Encrypting heap memory to evade scanning | |
104 | Library Proxy Loading | Using callback-based DLL loading to hide execution | |
105 | Evading Microsoft Defender Via Patching | Modifying Defender’s scanning behavior | |
106 | .NET Assemblies - Patching System.Environment.Exit | Modifying .NET APIs to prevent execution termination | |
107 | KnownDll Cache Poisoning Injection | Using KnownDll poisoning for stealth injection |