Dancing with Sysmon - Detection
Dancing with Sysmon - Detection
RED TEAM Operator: Windows Evasion Course
Buy now
Learn more
Intro and Setup
Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip
Shellcodes
Essentials
Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature
Non-privileged user vector
Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping
High-privileged user vector
Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon
Summary
Evasion Decision Tree
Your Feedback
Closing Words
Preview unavailable
You must log in or sign up to view this lesson.
Login
Sign up
RED TEAM Operator: Windows Evasion Course
Buy now
Learn more
Intro and Setup
Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip
Shellcodes
Essentials
Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature
Non-privileged user vector
Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping
High-privileged user vector
Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon
Summary
Evasion Decision Tree
Your Feedback
Closing Words