RED TEAM Operator: Windows Evasion Course
- Buy now
- Learn more
Intro and Setup

Course Introduction
Development VM Setup
RTO-WinEva.ova
WEv.zip
Essentials

Modern Detection Tech
Evasion Development Rules
Binary Entropy
Module Details
Binary Signature
Non-privileged user vector

Introduction To Process Unhooking
Hooks vs Code Injection
Process Unhooking - "Classic"
Hooks vs Hell's Gate
Hooks vs Halo's Gate
Process Unhooking - Perun's Fart
Silencing Process Event Tracing
Module Stomping
No-New-Thread Payload Execution
"Classic" PPID Spoofing
Changing Parents - Scheduler
Changing Parents - Emotet Method
Cmdline Arguments Spoofing
Assignment #1 - Hooks
Assignment #2 - Module Stomping
High-privileged user vector

Blinding Eventlog
Blocking EPP Comms - Listing Connections
Blocking EPP Comms - Firewall
Blocking EPP Comms - Routing Table (P1)
Blocking EPP Comms - Routing Table (P2)
Dancing with Sysmon - Detection
Dancing with Sysmon - Kill'em!
Dancing with Sysmon - Silent Gag
Assignment #3 - Sysmon
Assignment #4 - Sysmon
Summary

Evasion Decision Tree
Closing Words

Development VM Setup

Lesson unavailable

Please login to your account or buy the course.