Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
153 item(s) found so far for this keyword.
Unloading Sysmon Driver Anti-Monitoring
Sysmon is a tool that can be used to monitor system activity on Windows systems. It records various types of events, such as process creation, network connections, and registry changes, and stores them in the Windows Event Log. Security analysts can use this information to detect and investigate malicious activity on a system.
One way that malware can evade …
Unloading Module with FreeLibrary Antivirus/EDR Evasion
Malware authors often use various techniques to evade detection by AV/EDR solutions. One such technique involves checking for the presence of AV/EDR DLLs that may be loaded in the malware's address space and attempting to unload them before executing their malicious code.
To do this, the malware first uses the GetModuleHandleA function to retrieve a handle to the DLL, …
DLL Unhooking Antivirus/EDR Evasion
Endpoint Detection and Response (EDR) tools use a technique known as hooking to monitor sensitive system functions within the DLLs of loaded processes. Hooking is a method of live-patching system DLLs, enabling EDRs to intercept the flow of a program and evaluate its legitimacy.
Here's how it works: EDRs modify the first instructions of the functions within the DLLs. …