Process Reimaging

Process Manipulating

Process Reimaging is a technique used to evade detection by endpoint security solutions. It is a variation of the Process Hollowing or Process Doppelganging techniques, which are used to execute arbitrary code in the context of another process.

The Windows operating system has inconsistencies in how it determines the locations of process image FILE_OBJECTs, which can impact the ability …

Bypass User Account Control

Defense Evasion [Mitre]

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.

The impact to the user ranges from denying the operation under high enforcement …

Indicator Removal: Clear Windows Event Logs

Anti-Forensic

Defense Evasion [Mitre]

Event logging is a process that records important software and hardware events from various sources and stores them in a centralized location called an event log. This service is commonly used by applications and operating systems to track and troubleshoot issues, and can be a valuable tool for forensic investigations.

Event logs can provide valuable information about the actions …

DNS Tunneling

Network Evasion

Defense Evasion [Mitre]

DNS tunneling is a technique that uses the Domain Name System (DNS) protocol to transfer data in an encrypted and covert manner. It involves encoding the data of other programs or protocols in DNS queries and responses, and using DNS servers as a means of communication.

To carry out DNS tunneling, the attacker typically needs access to a compromised …

Indicator Removal: Timestomp

Anti-Forensic

Defense Evasion [Mitre]

Timestomping is a technique used by adversaries to modify the timestamps of a file, such as the modify, access, create, and change times. This technique is often used to hide the fact that a file has been modified or created by the adversary, making it more difficult for forensic investigators or file analysis tools to detect the changes.

By …

Execution Guardrails: Environmental Keying

Defense Evasion [Mitre]

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving …

Access Token Manipulation: Parent PID Spoofing

Process Manipulating

Defense Evasion [Mitre]

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified.

One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the …

Hijack Execution Flow: DLL Search Order Hijacking

Defense Evasion [Mitre]

Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

There are many ways an …

Domain Fronting

Network Evasion

Defense Evasion [Mitre]

Domain fronting is a technique used to hide the true destination of internet traffic. It may be used to hide the real destination of an offensive payload or is could be used to bypass censorship or any form of network restriction. The technique may be used through CDN infrastructure or on any infrastructure that perform separation between SSL and http …

Access Token Manipulation: Token Impersonation/Theft

Defense Evasion [Mitre]

Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that duplicates an existing token using DuplicateToken(Ex). The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to …

Search For Content

Search Result

Process Reimaging

Process Manipulating

Bypass User Account Control

Defense Evasion [Mitre]

Indicator Removal: Clear Windows Event Logs

Anti-Forensic

Defense Evasion [Mitre]

DNS Tunneling

Network Evasion

Defense Evasion [Mitre]

Indicator Removal: Timestomp

Anti-Forensic

Defense Evasion [Mitre]

Execution Guardrails: Environmental Keying

Defense Evasion [Mitre]

Access Token Manipulation: Parent PID Spoofing

Process Manipulating

Defense Evasion [Mitre]

Hijack Execution Flow: DLL Search Order Hijacking

Defense Evasion [Mitre]

Domain Fronting

Network Evasion

Defense Evasion [Mitre]

Access Token Manipulation: Token Impersonation/Theft

Defense Evasion [Mitre]