ippsec - Mimikatz obfuscation for AV/HIDS evasion

https://youtu.be/9pwMCHlNma4
#redteam #av #edrbypass

amber is a reflective PE packer for bypassing security products and mitigations. It can pack regularly compiled PE files into reflective payloads that can load and execute itself like a shellcode. It enables stealthy in-memory payload deployment that can be used to bypass anti-virus, firewall, IDS, IPS products and application white-listing mitigations.

https://github.com/EgeBalci/Amber

#bypass #av #evasion

Intensio-Obfuscator (Beta)

Takes a python source code and transform it into an obfuscated python code, replace name of variables - classes - functions to random chars and defined length, removes comments, line breaks and add to each line a random script with an always differents values.

https://github.com/Hnfull/Intensio-Obfuscator
#evasion #obfuscation #av

Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR

In this blog post we will explore the use of direct system calls, restore hooked API calls and ultimately combine this with a shellcode injection technique called sRDI. We will combine these techniques in proof of concept code which can be used to create a LSASS memory dump using Cobalt Strike, while not touching disk and evading AV/EDR monitored user-mode API calls.

https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/

#redteaming #evasion #av #bypass

Red Team Diary, Entry #1: Making NSA’s PeddleCheap RAT Invisible

The reason behind launching these posts is to engage the community and start a discussion around the techniques presented. This way, valuable insights and hopefully the readers’ own techniques can be shared in the “Responses” section at the bottom of each article.

https://medium.com/@d.bougioukas/red-team-diary-entry-1-making-nsas-peddlecheap-rat-invisible-f88ccbdc484d

#redteaming #av #evasion #rat

CarbonCopy


A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux

https://github.com/paranoidninja/CarbonCopy
#tools #pentesting #spoofing #av

Fuzzing the Windows API for AV Evasion

https://winternl.com/fuzzing-the-windows-api-for-av-evasion/
#evasion #bypass #av #windows

Oh, so you have an antivirus… name every bug

In this blog I will be disclosing about 8 0-day vulnerability and all of them are still unknow to the vendors, don’t expect those bugs to be working for more than a week or two cause probably they will release an emergency security patches to fix those bugs.

https://halove23.blogspot.com/2020/12/oh-so-you-have-antivirus-nameevery-bug.html

#windows #lpe #av #vulnerability